snort-inline-users — The goal of this list is to help users debug/use snort_inline

Re: [Snort-inline-users] Dual CPU's

[Ken G. <ken...@ro...>]

that is an operating system issue. i am running snort_inline on a dual
cpu system with Fedora Core 3.

Bill Warren wrote:

>Will Snort inline run on dual CPU's?  The reason that I ask is that I am
>going to be getting a dual PIII 500mhz with 1 gig of RAM.  I am not
>worried about the speed or if Snort can use the dual CPU's, but will it
>run correctly?
>
>Thanks,
>Bill
>  
>

[Snort-inline-users] Dual CPU's

[Bill W. <bw...@op...>]

Will Snort inline run on dual CPU's?  The reason that I ask is that I am
going to be getting a dual PIII 500mhz with 1 gig of RAM.  I am not
worried about the speed or if Snort can use the dual CPU's, but will it
run correctly?

Thanks,
Bill

Re: [Snort-inline-users] Snort-inline 2.3 final and its binaries

[Will M. <wil...@gm...>]

Yes, there will be final release.  We are trying to figure out a way
to properly reassemble in Window out-of-sequence packets for
stream4inline.  It's a whole different ball game when you are sitting
in inline and cannot wait for an ack to indicate a packets validity.

On top of this Victor and I are both very busy.  He is trying to
finish his degree, and just moved into a new house.  I'm in the middle
of planning a wedding and have been putting in very long hours at my
paying job ;-).  If anybody wants a more detailed explanation of the
problem or you think you can help, just shoot me an e-mail and I'll
send you the latest diff.

Anybody on the list going to Defcon this year?=20

Regards,

Will=20

On 7/19/05, Federico Petronio <pe...@ac...> wrote:
> Hello, I would like to know if there is any plan to release the final
> snort-inline 2.3 and to publish the corresponding binaries.
>=20
> Thanks a lot!
> --
>                                         Federico Petronio
>                                         pe...@ac...
>=20
>=20
> -------------------------------------------------------
> SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
> from IBM. Find simple to follow Roadmaps, straightforward articles,
> informative Webcasts and more! Get everything you need to get up to
> speed, fast. http://ads.osdn.com/?ad_id=3D7477&alloc_id=3D16492&op=3Dclic=
k
> _______________________________________________
> Snort-inline-users mailing list
> Sno...@li...
> https://lists.sourceforge.net/lists/listinfo/snort-inline-users
>

[Snort-inline-users] Snort-inline 2.3 final and its binaries

[Federico P. <pe...@ac...>]

Hello, I would like to know if there is any plan to release the final
snort-inline 2.3 and to publish the corresponding binaries.

Thanks a lot!
-- 
                                        Federico Petronio
                                        pe...@ac...

Re: [Snort-inline-users] http inspect alerting on client traffic

[Will M. <wil...@gm...>]

Hmmmmm I think it would be better to specify var HTTP_SERVERS and var
HOME_NET to  just include the subnet of your local lan.  That should
fix your problem.

Regards,

Will

On 7/18/05, tut...@pa... <tut...@pa...> wrote:
> Hi,
>=20
> I've had snort-inline running on my home network for a while now,
> and I've just noticed that http_inspect is alerting, (and presumably
> dropping) packets from client machines on my local network to
> public internet sites.
>=20
> Is the correct way to prevent this to replace my default
> http_inspect_server entry with entries for the ip address for my http
> server ?
>=20
> Thanks
> tut.
>=20
>=20
> -------------------------------------------------------
> SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
> from IBM. Find simple to follow Roadmaps, straightforward articles,
> informative Webcasts and more! Get everything you need to get up to
> speed, fast. http://ads.osdn.com/?ad_id=3D7477&alloc_id=3D16492&op=3Dclic=
k
> _______________________________________________
> Snort-inline-users mailing list
> Sno...@li...
> https://lists.sourceforge.net/lists/listinfo/snort-inline-users
>

[Snort-inline-users] http inspect alerting on client traffic

[<tut...@pa...>]

Hi,

I've had snort-inline running on my home network for a while now,
and I've just noticed that http_inspect is alerting, (and presumably
dropping) packets from client machines on my local network to
public internet sites.

Is the correct way to prevent this to replace my default
http_inspect_server entry with entries for the ip address for my http
server ?

Thanks
tut.

Re: [Snort-inline-users] need a snort_inline document

[Ken G. <ken...@ro...>]

right. run snort inline like this:

snort -D -c /etc/snort_inline.conf -Q -l /var/log/snort_inline -t
/var/log/snort_inline

D = daemon
c = config
Q = queue mode
l = logs
t = chroot dir

since im bridge i have iptables IN/OUT for accept and FORWARD is QUEUE.
but what you have will work too for standard firewall system.

ozgur uncuoglu wrote:

> my english is not perfect.I say using "only" iptables rules is not 
> enough to provide more security.packet filtering does not stop hackers:(
>
> compile snort_inline
> add ip_queue module
> setup some snort rules
> iptables -A input -J Queue
> start snort_inline
>
> after this,incoming all packets should pass through IPS.
> is this works ?
>
> Ken Garland wrote:
>
>>saying snort_inline is more powerful than iptables is like saying a
>>peanut butter and jelly sandwich tastes better without the jelly. its
>>just a peanut butter sandwich at that point, much like snort_inline
>>without iptables is just snort IDS, not IPS.
>>
>>You must have both as snort inline feeds off iptables queue.
>>
>>compile iptables and queue into your kernel, or make modules. i use a
>>bridging system so that needs to be compiled in as well.
>>
>>then simply setup iptables for queuing and compile snort_inline, setup
>>some rules and you are done. sounds simple? well of course there will be
>>some snags during the event but i have not run across a 'howto' to walk
>>people though it just yet.
>>
>>oun...@is... wrote:
>>
>>  
>>
>>>sorry about my previous message.
>>>
>>>I need a full document about installing snort-inline on my debian
>>>box.additionally configuring with iptables and ip_queue.I think
>>>snort-inline is more powerfull than writing iptables rules and I'm going
>>>to install it for a gateway machine without web server mysql ftp etc.Its
>>>just serve to corporate users to access to the internet.
>>>
>>>thanks
>>>
>>>
>>>
>>>
>>>
>>>-------------------------------------------------------
>>>This SF.Net email is sponsored by the 'Do More With Dual!' webinar happening
>>>July 14 at 8am PDT/11am EDT. We invite you to explore the latest in dual
>>>core and dual graphics technology at this free one hour event hosted by HP,
>>>AMD, and NVIDIA.  To register visit http://www.hp.com/go/dualwebinar
>>>_______________________________________________
>>>Snort-inline-users mailing list
>>>Sno...@li...
>>>https://lists.sourceforge.net/lists/listinfo/snort-inline-users
>>> 
>>>
>>>    
>>>
>>
>>  
>>
>

Re: [Snort-inline-users] need a snort_inline document

[ozgur u. <oun...@is...>]

my english is not perfect.I say using "only" iptables rules is not  
enough to provide more security.packet filtering does not stop hackers:(

compile snort_inline
add ip_queue module
setup some snort rules
iptables -A input -J Queue
start snort_inline

after this,incoming all packets should pass through IPS.
is this works ?

Ken Garland wrote:

>saying snort_inline is more powerful than iptables is like saying a
>peanut butter and jelly sandwich tastes better without the jelly. its
>just a peanut butter sandwich at that point, much like snort_inline
>without iptables is just snort IDS, not IPS.
>
>You must have both as snort inline feeds off iptables queue.
>
>compile iptables and queue into your kernel, or make modules. i use a
>bridging system so that needs to be compiled in as well.
>
>then simply setup iptables for queuing and compile snort_inline, setup
>some rules and you are done. sounds simple? well of course there will be
>some snags during the event but i have not run across a 'howto' to walk
>people though it just yet.
>
>oun...@is... wrote:
>
>  
>
>>sorry about my previous message.
>>
>>I need a full document about installing snort-inline on my debian
>>box.additionally configuring with iptables and ip_queue.I think
>>snort-inline is more powerfull than writing iptables rules and I'm going
>>to install it for a gateway machine without web server mysql ftp etc.Its
>>just serve to corporate users to access to the internet.
>>
>>thanks
>>
>>
>>
>>
>>
>>-------------------------------------------------------
>>This SF.Net email is sponsored by the 'Do More With Dual!' webinar happening
>>July 14 at 8am PDT/11am EDT. We invite you to explore the latest in dual
>>core and dual graphics technology at this free one hour event hosted by HP,
>>AMD, and NVIDIA.  To register visit http://www.hp.com/go/dualwebinar
>>_______________________________________________
>>Snort-inline-users mailing list
>>Sno...@li...
>>https://lists.sourceforge.net/lists/listinfo/snort-inline-users
>> 
>>
>>    
>>
>
>  
>

Re: [Snort-inline-users] need a snort_inline document

[Ken G. <ken...@ro...>]

saying snort_inline is more powerful than iptables is like saying a
peanut butter and jelly sandwich tastes better without the jelly. its
just a peanut butter sandwich at that point, much like snort_inline
without iptables is just snort IDS, not IPS.

You must have both as snort inline feeds off iptables queue.

compile iptables and queue into your kernel, or make modules. i use a
bridging system so that needs to be compiled in as well.

then simply setup iptables for queuing and compile snort_inline, setup
some rules and you are done. sounds simple? well of course there will be
some snags during the event but i have not run across a 'howto' to walk
people though it just yet.

oun...@is... wrote:

>sorry about my previous message.
>
>I need a full document about installing snort-inline on my debian
>box.additionally configuring with iptables and ip_queue.I think
>snort-inline is more powerfull than writing iptables rules and I'm going
>to install it for a gateway machine without web server mysql ftp etc.Its
>just serve to corporate users to access to the internet.
>
>thanks
>
>
>
>
>
>-------------------------------------------------------
>This SF.Net email is sponsored by the 'Do More With Dual!' webinar happening
>July 14 at 8am PDT/11am EDT. We invite you to explore the latest in dual
>core and dual graphics technology at this free one hour event hosted by HP,
>AMD, and NVIDIA.  To register visit http://www.hp.com/go/dualwebinar
>_______________________________________________
>Snort-inline-users mailing list
>Sno...@li...
>https://lists.sourceforge.net/lists/listinfo/snort-inline-users
>  
>

[Snort-inline-users] need a snort_inline document

[<oun...@is...>]

sorry about my previous message.

I need a full document about installing snort-inline on my debian
box.additionally configuring with iptables and ip_queue.I think
snort-inline is more powerfull than writing iptables rules and I'm going
to install it for a gateway machine without web server mysql ftp etc.Its
just serve to corporate users to access to the internet.

thanks

Re: [Snort-inline-users] Help in useing Snort_Inline

[<oun...@is...>]

I need a full document about installing snort-inline on my debian
box.additionally configuring with iptables and ip_queue.I think
snort-inline is more powerfull than writing iptables rules and I'm going
to install it for a gateway machine without web server mysql ftp etc.Its
just serve to corporate users to access to the internet.

thanks

Re: [Snort-inline-users] Help in useing Snort_Inline

[Will M. <wil...@gm...>]

snort_inline is not supported on windows, only on linux and freebsd.

Regards,

Will

On 11 Jul 2005 08:59:36 -0000, Bharanidharan Shanmugam
<bha...@re...> wrote:
>=20
>=20
>  Hi all,
> =20
>  I'm very new to this SNORT_Inline........ can anybody help me out in
> starting of Snort_inline....... ie how to deploy in Win environemnt. and
> other things to do it in my research work......=20
>=20
>

[Snort-inline-users] Help in useing Snort_Inline

[Bharanidharan S. <bha...@re...>]

Hi all,=0A=0AI'm very new to this SNORT_Inline........ can anybody help me =
out in starting of Snort_inline....... ie how to deploy in Win environemnt.=
 and other things to do it in my research work......

Re: [Snort-inline-users] Flowbits error

[Will M. <wil...@gm...>]

List,=20

I promise that we will have a new release out soon, we are ironing out
some bugs in stream4inline.

Regards,

Will

On 6/27/05, Thanasin Jitkaew <tha...@gb...> wrote:
> The new version of snort + clamav patch can be found at
> http://www.bleedingsnort.com/cgi-bin/viewcvs.cgi/?root=3DSnort-Clamav
>=20
> It is snort-2.3.3-clam.tar.bz2
>=20
> Regards,
> Thanasin Jitkaew
>=20
>=20
> lma...@ar... wrote:
>=20
> >Hi,
> >
> >i use snort_inline and I've got an error when i try to run it :
> >
> >ERROR: FLOWBITS ERROR: The number of flowbit IDs in the current ruleset =
exceed the maximum number of IDs that are allowed.
> >
> >I run version 2.3.0RC1 of snort_inline. I download the rules on snort.or=
g and convert them with snortconfig (http://www.shmoo.com/~bmc/software/sno=
rtconfig/)
> >
> >i search on the web and i found this mesage :
> >
> >http://www.mcabee.org/lists/snort-users/Mar-05/msg00410.html
> >
> >but i can't update my snort version because i have to use snort_inline.
> >
> >How can i resolve my problem?
> >
> >Thanks in advance!
> >
> >lm.
> >
> >
> >
> >
> >
> >-------------------------------------------------------
> >SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
> >from IBM. Find simple to follow Roadmaps, straightforward articles,
> >informative Webcasts and more! Get everything you need to get up to
> >speed, fast. http://ads.osdn.com/?ad_id=3D7477&alloc_id=3D16492&op=3Dcli=
ck
> >_______________________________________________
> >Snort-inline-users mailing list
> >Sno...@li...
> >https://lists.sourceforge.net/lists/listinfo/snort-inline-users
> >
> >
> >
> >
>=20
>=20
>=20
> -------------------------------------------------------
> SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
> from IBM. Find simple to follow Roadmaps, straightforward articles,
> informative Webcasts and more! Get everything you need to get up to
> speed, fast. http://ads.osdn.com/?ad_id=3D7477&alloc_id=3D16492&op=3Dclic=
k
> _______________________________________________
> Snort-inline-users mailing list
> Sno...@li...
> https://lists.sourceforge.net/lists/listinfo/snort-inline-users
>

Re: [Snort-inline-users] Flowbits error

[Thanasin J. <tha...@gb...>]

The new version of snort + clamav patch can be found at
http://www.bleedingsnort.com/cgi-bin/viewcvs.cgi/?root=Snort-Clamav

It is snort-2.3.3-clam.tar.bz2

Regards,
Thanasin Jitkaew


lma...@ar... wrote:

>Hi,
>
>i use snort_inline and I've got an error when i try to run it :
>
>ERROR: FLOWBITS ERROR: The number of flowbit IDs in the current ruleset exceed the maximum number of IDs that are allowed.
>
>I run version 2.3.0RC1 of snort_inline. I download the rules on snort.org and convert them with snortconfig (http://www.shmoo.com/~bmc/software/snortconfig/)
>
>i search on the web and i found this mesage : 
>
>http://www.mcabee.org/lists/snort-users/Mar-05/msg00410.html
>
>but i can't update my snort version because i have to use snort_inline.
>
>How can i resolve my problem?
>
>Thanks in advance!
>
>lm.
>
>
>
>
>
>-------------------------------------------------------
>SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
>from IBM. Find simple to follow Roadmaps, straightforward articles,
>informative Webcasts and more! Get everything you need to get up to
>speed, fast. http://ads.osdn.com/?ad_id=7477&alloc_id=16492&op=click
>_______________________________________________
>Snort-inline-users mailing list
>Sno...@li...
>https://lists.sourceforge.net/lists/listinfo/snort-inline-users
>
>
>  
>

Re: [Snort-inline-users] Flowbits error

[Lance S. <la...@ho...>]

On Jun 27, 2005, at 10:48, Bert van Leeuwen wrote:

> I was under the impression all the newer versions of snort (from about 
> 2.3.3 onwards or so) include snort-inline by default? You just have to 
> enable the option when using the configure script to build the code, 
> then run snort with the -Q option to make it use IP_QUEUE (same as 
> snort_inline).

Just curious.  Are you guys seeing the new pre-compiled versions (such 
as snort-rpm) with IP-QUEUE option enabled/compiled in?

lance

Re: [Snort-inline-users] Flowbits error

[Bert v. L. <ber...@gm...>]

I was under the impression all the newer versions of snort (from about
2.3.3onwards or so) include snort-inline by default? You just have to
enable the
option when using the configure script to build the code, then run snort=20
with the -Q option to make it use IP_QUEUE (same as snort_inline).

On 6/27/05, lma...@ar... <lma...@ar...> wrote:
>=20
>=20
> but i can't update my snort version because i have to use snort_inline.
>=20
>

Re: [Snort-inline-users] Flowbits error

[Jason <sec...@br...>]

Check the archives. This was covered a while ago.

http://www.google.com/search?q=flowbits+error

lma...@ar... wrote:
> Hi,
> 
> i use snort_inline and I've got an error when i try to run it :
> 
> ERROR: FLOWBITS ERROR: The number of flowbit IDs in the current ruleset exceed the maximum number of IDs that are allowed.
> 
> I run version 2.3.0RC1 of snort_inline. I download the rules on snort.org and convert them with snortconfig (http://www.shmoo.com/~bmc/software/snortconfig/)
> 
> i search on the web and i found this mesage : 
> 
> http://www.mcabee.org/lists/snort-users/Mar-05/msg00410.html
> 
> but i can't update my snort version because i have to use snort_inline.
> 
> How can i resolve my problem?
> 
> Thanks in advance!
> 
> lm.
> 
> 
> 
> 
> 
> -------------------------------------------------------
> SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
> from IBM. Find simple to follow Roadmaps, straightforward articles,
> informative Webcasts and more! Get everything you need to get up to
> speed, fast. http://ads.osdn.com/?ad_id=7477&alloc_id=16492&op=click
> _______________________________________________
> Snort-inline-users mailing list
> Sno...@li...
> https://lists.sourceforge.net/lists/listinfo/snort-inline-users
> 

[Snort-inline-users] Flowbits error

[<lma...@ar...>]

Hi,

i use snort_inline and I've got an error when i try to run it :

ERROR: FLOWBITS ERROR: The number of flowbit IDs in the current ruleset exceed the maximum number of IDs that are allowed.

I run version 2.3.0RC1 of snort_inline. I download the rules on snort.org and convert them with snortconfig (http://www.shmoo.com/~bmc/software/snortconfig/)

i search on the web and i found this mesage : 

http://www.mcabee.org/lists/snort-users/Mar-05/msg00410.html

but i can't update my snort version because i have to use snort_inline.

How can i resolve my problem?

Thanks in advance!

lm.

Re: [Snort-inline-users] Ruleset Functions

[Will M. <wil...@gm...>]

On 6/24/05, Ken Garland <ken...@ro...> wrote:
> What are the available functions for the rules file? In the readme file
> I see:
>=20
> drop
> reject
> sdrop
>=20
> Are all of the typical snort functions available to snort-inline? If I
> setup an alert rule can snort-inline handle it?

Yes
> Also has anyone had success with using 'config layer2resets' ? I'd like
> to set this up based on MAC address.

There is a bugfix for the current layer2rests code that is going to be
included in snort_inline-2.3.3 and snort-2.4.  If you want it right
away let me know and I'll forward it to you.  Could you please clarify
what you mean by "set this up based on MAC address"

Regards,

Will
> Thanks,
> Ken
>=20
>=20
> -------------------------------------------------------
> SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
> from IBM. Find simple to follow Roadmaps, straightforward articles,
> informative Webcasts and more! Get everything you need to get up to
> speed, fast. http://ads.osdn.com/?ad_id=3D7477&alloc_id=3D16492&op=3Dclic=
k
> _______________________________________________
> Snort-inline-users mailing list
> Sno...@li...
> https://lists.sourceforge.net/lists/listinfo/snort-inline-users
>

[Snort-inline-users] Ruleset Functions

[Ken G. <ken...@ro...>]

What are the available functions for the rules file? In the readme file
I see:

drop
reject
sdrop

Are all of the typical snort functions available to snort-inline? If I
setup an alert rule can snort-inline handle it?

Also has anyone had success with using 'config layer2resets' ? I'd like
to set this up based on MAC address.

Thanks,
Ken

[Snort-inline-users] IPS in transparent mode?

[christopher <ch...@sy...>]

Dear all snort + inline user,

i having an idea on IPS failure in mind. then the network will be down.

so is there any solution to make the IPS into transparent mode?

thanks

chris

Re: [Snort-inline-users] pf and snort_inline again

[Nick R. <ni...@ro...>]

On Sun, 19 Jun 2005, Mohamed Berzig wrote:

> Hello,
> I found the following interview on the site:
>
> http://www.onlamp.com/pub/a/bsd/2004/05/06/pf_developers.html?page=4
>
> Federico: Mike, your job focuses on IDS development. Had you any ideas
> to make PF capable of interacting with an IDS like Snort?
> MF: There are a few levels of interaction between a firewall and an
> IDS. I believe Snort has been able to do intrusion detection on any
> packet logged by PF for a year or two now (PF logged packets appear on
> the pflogd0 virtual interface which you can monitor with many libpcap
> based programs like tcpdump or ethereal).
> There are already two ways to emulate Linux's DIVERT sockets and turn
> an IDS into an IPS (Intrusion Prevention System). One could use PF to
> route the packets to a tunnel device and read them there. Or one could
> block the packet in PF and watch the full packet show up on the
> pflogd0 logging interface.
> And a passive IDS running on the firewall could easily tell PF to kill
> all of an attackers connections and add his IP address to a blacklist
> or even redirect any new connections from him to a honeypot.
> The tools are all there. All it takes is someone to add the code to
> Snort. Someone whose employer doesn't compete with Snort :-).
>
> According to this interview there is possible to make interact
> snort_inline with PF, is it somebody who has to test this method?

 	I'll gladly look at it.


Nick Rogness <ni...@ro...>
-
   How many people here have telekenetic powers? Raise my hand.
   				-Emo Philips

[Snort-inline-users] pf and snort_inline again

[Mohamed B. <mb...@gm...>]

Hello,=20
I found the following interview on the site:

http://www.onlamp.com/pub/a/bsd/2004/05/06/pf_developers.html?page=3D4

Federico: Mike, your job focuses on IDS development. Had you any ideas
to make PF capable of interacting with an IDS like Snort?
MF: There are a few levels of interaction between a firewall and an
IDS. I believe Snort has been able to do intrusion detection on any
packet logged by PF for a year or two now (PF logged packets appear on
the pflogd0 virtual interface which you can monitor with many libpcap
based programs like tcpdump or ethereal).
There are already two ways to emulate Linux's DIVERT sockets and turn
an IDS into an IPS (Intrusion Prevention System). One could use PF to
route the packets to a tunnel device and read them there. Or one could
block the packet in PF and watch the full packet show up on the
pflogd0 logging interface.
And a passive IDS running on the firewall could easily tell PF to kill
all of an attackers connections and add his IP address to a blacklist
or even redirect any new connections from him to a honeypot.
The tools are all there. All it takes is someone to add the code to
Snort. Someone whose employer doesn't compete with Snort :-).

According to this interview there is possible to make interact
snort_inline with PF, is it somebody who has to test this method?
=20
Sincerly.

Re: [Snort-inline-users] problem installing snort-inline

[christopher <ch...@sy...>]

you need to install the iptable-devel and the libnet


On Wed, 2005-06-15 at 22:58 -0400, Brower, Robert wrote:
> I'm a linux and snort newbie and I'm having a problem getting snort-
> inline installed and hoping someone here can help out.
> 
>  
> 
> When running  ./configure --enable-inline I receive the following
> error:
> 
> configure: error: libipq.h not found ...
> 
>  
> 
> Any ideas?
> 
>  
> 
> Thanks in advance
> 
> Robert G. Brower 
> University of Pennsylvania 
> School of Nursing 
> Office of Technology and Information Systems 
> Computer Lab Manager/Senior IT Support Specialist 
> 420 Guardian Dr 
> Philadelphia Pa, 19104 
> 
>  
> 
>