Re: [Snort-inline-users] portscan preprocessors and drop mode

[Rob M. <rv...@ca...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> I would be most interested in getting the arpspoof preprocessor to block. 
> I don't believe it does right now.

You are correct.  It does not drop at this time.  I'll need to check out 
the preproc...

> I would also like to know how to compile snort statically so I don't have
> to repatch/compile on each sensor that I setup.  I just want to be able to
> copy/paste the binary like the binary package for snort-inline on
> sourceforge.

This kind of depends if you are trying to compile it statically with mysql 
support.  I haven't been able to compile it statically with mysql :(

These are the steps I use to create the static snort_inline binary:

1.  ./configure
2.  vi src/Makefile
       a.  change 
       snort_inline_LDFLAGS =
 
       to 

       snort_inline_LDFLAGS = -static

3.  make

If you have already compiled this source, do a make clean before you start 
to make sure you get rid of any old object files.  This should put a 
statically linked binary in the src directory.  Just to verify that you 
have what you want, run file on snort_inline.  It should tell you that you 
have a static binary.

Rob

P.S.  Let me know if you get it to compile statically with mysql support.

-----BEGIN PGP SIGNATURE-----
Version: PGP 6.5.8
Comment: Made with pgp4pine 1.76

iQA+AwUBP7GVgvnAyY+9KLjdEQI8egCfW2cX674706c7mZc2FmJcVpSSKxIAmMHa
eyUMIuq9olsNFw66qi8EuOM=
=xfMU
-----END PGP SIGNATURE-----