Re: [Snort-inline-users] Query

[C.G.Senthilkumar. <che...@cs...>]

Would using a firewall like iptables or ipfw help? You could
divert packets to a user process, modify and re-inject it.

For effeciency purposes, one could directly make use of the
netfilter's libipt. Would this help?

My 2 cents.
Senthil.

On Fri, 17 Feb 2006, Nick Rogness wrote:

>
>> hello ,
>>   I am doing a small project in networking . I want to
>> compress packets at server side and then send it to
>> the receiver where it will be decompressed.My problem
>> is where to capture packets and modify it.Snort helps
>> in capturing packets but does it support any feature
>> that allows me to change contents of packets.
>>
>> I am really stuck up at this point .Any help will be
>> appreciated.
>>
>
>  Snort_inline is not built for this type of functionality.  Even if you
> did add a compression plugin, you would be disappointed in the speed due
> to the overhead.  You should be using client-server model software for
> something like this.  I would suggest:
>
>  - Build a kernel module (like Netgraph)
>  - Modify a tunnelling technology like GRE/IPIP
>  - Look for existing apps that already do this (search google).
>
> FWIW,
>
> Nick Rogness <ni...@ro...>
>
>
>
> -------------------------------------------------------
> This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
> for problems?  Stop!  Download the new AJAX search engine that makes
> searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
> http://sel.as-us.falkag.net/sel?cmd=lnk&kid=103432&bid=230486&dat=121642
> _______________________________________________
> Snort-inline-users mailing list
> Sno...@li...
> https://lists.sourceforge.net/lists/listinfo/snort-inline-users
>

-- 
Today's fortune:
If the automobile had followed the same development as the computer, a
Rolls-Royce would today cost $100, get a million miles per per gallon,
and explode once a year killing everyone inside.
 		-- Robert Cringely, InfoWorld