Re: [Snort-inline-users] low traffic from debian or ubuntu throughsnort inline

[Victor J. <li...@in...>]

I think this issue could be caused by the broken window scaling
normalization code we had in that release. Please see my blog post about
it here:
http://www.inliniac.net/blog/2007/09/04/window-scaling-normalization-in-snort_inline-broken-by-design.html

Regards,
Victor

Alain DEGUILLE wrote:
> Hi,
>
> my kernel : 2.6.18-53.1.13.el5PAE
>
> thx
>
> -----Message d'origine-----
> De : Eric Leblond [mailto:er...@in...] 
> Envoyé : samedi 12 juillet 2008 00:56
> À : Alain DEGUILLE
> Cc : sno...@li...
> Objet : Re: [Snort-inline-users] low traffic from debian or ubuntu
> throughsnort inline
>
> Hi,
>
> On Friday, 2008 July 11 at 15:42:52 +0200, Alain DEGUILLE wrote:
>   
>> Hello,
>>  
>> I'm using snort inline (snort_inline-2.6.1.5) on my firewall (Linux 
>> Redhat Entreprise 5) with iptable, to secure my web server on dmz.
>> It works very well, except when http client comes from Linux Debian or 
>> Ubuntu. There traffic are very slowly.
>>  
>> Do you know this problem ?
>>     
>
> Which kernel are you using ? 2.6.22.x with X < 4 has a problem when
> nfqueuing packet with some specific packet size.
>
> Cordialement,
> --
> Eric Leblond
> INL: http://www.inl.fr/
> NuFW: http://www.nufw.org/
>   
> ------------------------------------------------------------------------
>
> -------------------------------------------------------------------------
> This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
> Build the coolest Linux based applications with Moblin SDK & win great prizes
> Grand prize is a trip for two to an Open Source event anywhere in the world
> http://moblin-contest.org/redirect.php?banner_id=100&url=/
> ------------------------------------------------------------------------
>
> _______________________________________________
> Snort-inline-users mailing list
> Sno...@li...
> https://lists.sourceforge.net/lists/listinfo/snort-inline-users
>