Re: [Snort-inline-users] low traffic from debian or ubuntu throughsnort inline

[Alain D. <ade...@sq...>]

Thx,

It was my first idea. But i tried "disable_norm_wscale" and it doesn't
change anything.
Now i try "norm_wscale_max 14" like you say a the button of the site, and it
work !!

I don't understand why disable_norm_wsale don't work ?

What ever, i would like to thanks you a lot !!!

thx
-----Message d'origine-----
De : sno...@li...
[mailto:sno...@li...] De la part de
Victor Julien
Envoyé : mardi 15 juillet 2008 09:51
À : sno...@li...
Objet : Re: [Snort-inline-users] low traffic from debian or ubuntu
throughsnort inline

I think this issue could be caused by the broken window scaling
normalization code we had in that release. Please see my blog post about it
here:
http://www.inliniac.net/blog/2007/09/04/window-scaling-normalization-in-snor
t_inline-broken-by-design.html

Regards,
Victor

Alain DEGUILLE wrote:
> Hi,
>
> my kernel : 2.6.18-53.1.13.el5PAE
>
> thx
>
> -----Message d'origine-----
> De : Eric Leblond [mailto:er...@in...] Envoyé : samedi 12 juillet 2008 
> 00:56 À : Alain DEGUILLE Cc : sno...@li...
> Objet : Re: [Snort-inline-users] low traffic from debian or ubuntu 
> throughsnort inline
>
> Hi,
>
> On Friday, 2008 July 11 at 15:42:52 +0200, Alain DEGUILLE wrote:
>   
>> Hello,
>>  
>> I'm using snort inline (snort_inline-2.6.1.5) on my firewall (Linux 
>> Redhat Entreprise 5) with iptable, to secure my web server on dmz.
>> It works very well, except when http client comes from Linux Debian 
>> or Ubuntu. There traffic are very slowly.
>>  
>> Do you know this problem ?
>>     
>
> Which kernel are you using ? 2.6.22.x with X < 4 has a problem when 
> nfqueuing packet with some specific packet size.
>
> Cordialement,
> --
> Eric Leblond
> INL: http://www.inl.fr/
> NuFW: http://www.nufw.org/
>   
> ----------------------------------------------------------------------
> --
>
> ----------------------------------------------------------------------
> --- This SF.Net email is sponsored by the Moblin Your Move Developer's 
> challenge Build the coolest Linux based applications with Moblin SDK & 
> win great prizes Grand prize is a trip for two to an Open Source event 
> anywhere in the world 
> http://moblin-contest.org/redirect.php?banner_id=100&url=/
> ----------------------------------------------------------------------
> --
>
> _______________________________________________
> Snort-inline-users mailing list
> Sno...@li...
> https://lists.sourceforge.net/lists/listinfo/snort-inline-users
>   


-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great
prizes Grand prize is a trip for two to an Open Source event anywhere in the
world http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Snort-inline-users mailing list
Sno...@li...
https://lists.sourceforge.net/lists/listinfo/snort-inline-users