Menu
▾
▴
snort-inline-users — The goal of this list is to help users debug/use snort_inline
You can subscribe to this list here.
| 2003 |
Jan
|
Feb
|
Mar
|
Apr
(1) |
May
(15) |
Jun
(23) |
Jul
(54) |
Aug
(20) |
Sep
(18) |
Oct
(19) |
Nov
(36) |
Dec
(30) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2004 |
Jan
(48) |
Feb
(16) |
Mar
(36) |
Apr
(36) |
May
(45) |
Jun
(47) |
Jul
(93) |
Aug
(29) |
Sep
(28) |
Oct
(42) |
Nov
(45) |
Dec
(53) |
| 2005 |
Jan
(62) |
Feb
(51) |
Mar
(65) |
Apr
(28) |
May
(57) |
Jun
(23) |
Jul
(24) |
Aug
(72) |
Sep
(16) |
Oct
(53) |
Nov
(53) |
Dec
(3) |
| 2006 |
Jan
(56) |
Feb
(6) |
Mar
(15) |
Apr
(14) |
May
(35) |
Jun
(57) |
Jul
(35) |
Aug
(7) |
Sep
(22) |
Oct
(16) |
Nov
(18) |
Dec
(9) |
| 2007 |
Jan
(8) |
Feb
(3) |
Mar
(11) |
Apr
(35) |
May
(6) |
Jun
(10) |
Jul
(26) |
Aug
(4) |
Sep
|
Oct
(29) |
Nov
|
Dec
(7) |
| 2008 |
Jan
(1) |
Feb
(2) |
Mar
(2) |
Apr
(13) |
May
(8) |
Jun
(3) |
Jul
(19) |
Aug
(20) |
Sep
(6) |
Oct
(5) |
Nov
|
Dec
(4) |
| 2009 |
Jan
(1) |
Feb
|
Mar
(1) |
Apr
|
May
|
Jun
(10) |
Jul
(2) |
Aug
(5) |
Sep
|
Oct
(1) |
Nov
|
Dec
(5) |
| 2010 |
Jan
(10) |
Feb
(10) |
Mar
(2) |
Apr
|
May
(7) |
Jun
|
Jul
|
Aug
|
Sep
|
Oct
|
Nov
(1) |
Dec
|
| 2011 |
Jan
|
Feb
(4) |
Mar
|
Apr
|
May
|
Jun
|
Jul
|
Aug
|
Sep
|
Oct
|
Nov
|
Dec
|
| 2012 |
Jan
|
Feb
|
Mar
|
Apr
(1) |
May
|
Jun
|
Jul
|
Aug
|
Sep
|
Oct
|
Nov
|
Dec
|
| 2013 |
Jan
|
Feb
(2) |
Mar
(3) |
Apr
|
May
|
Jun
|
Jul
|
Aug
|
Sep
|
Oct
|
Nov
|
Dec
|
|
From: Richard C. <ric...@gm...> - 2005-02-28 16:33:27
|
Running an IPS in bridge mode is more secure because your interfaces that are blocking the traffic do not have IP addresses associated with them which makes it difficult for a hacker to see your IPS in line much less attack it. Most IPSs run in bridge mode so I would suggest keeping this configuration. You can do your NAT on your router or other network device. -Rich On Mon, 28 Feb 2005 12:42:56 +0700 (ICT), tha...@gb... <tha...@gb...> wrote: > Running Snort-inline in which mode should be better ? > bettwen bridge mode and nat mode .. > > now i'm running my snort-inline with bridge mode and it's work fine for me. > i've place my snort-inline box after my router. > > Are there any criterias to concern about choosing bettween bridge and nat ? > > Just wanna share ideas :) > > Regards, > Thanasin > > ------------------------------------------------------- > SF email is sponsored by - The IT Product Guide > Read honest & candid reviews on hundreds of IT Products from real users. > Discover which products truly live up to the hype. Start reading now. > http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click > _______________________________________________ > Snort-inline-users mailing list > Sno...@li... > https://lists.sourceforge.net/lists/listinfo/snort-inline-users > -- Thanks, Rich Compton |
|
From: Will M. <wil...@gm...> - 2005-02-28 13:19:17
|
They changed a function from 0.7x to 0.8x in libclamav, you should be ok if you use snort-inline-2.3.0-RC1. Do me a favor and downlolad and try to compile support for 2.3.0-RC1, and let me know if you get the same error. I'll look at backporting the cl_buildtrie changes to 2.2.0. Regards, Wil On Mon, 28 Feb 2005 00:34:02 -0500, Christopher Black <bla...@um...> wrote: > Yes sir, that's the configuration it's currently running in on quite a > few of our client machines. This is the exact same image, but with the > extra flag to configure. >=20 > Will Metcalf wrote: > > Hmmm does it work ok if you don't --enable-clamav? > > > > Regards, > > > > Will > > On Sun, 27 Feb 2005 18:29:42 -0500, Christopher Black > > <bla...@um...> wrote: > > > >>Excellent information, thank you. > >> > >>Using snort_inline-2.2.0a and ClamAV 0.8.3, snort_inline crashes > >>immediately on boot with this error: > >> > >>rcmdsh: unknown user: =EF=BF=BD=EF=BF=BD=EF=BF=BD$=EF=BF=BDPj=04V=EF=BF= =BDs=EF=BF=BD=EF=BF=BD=EF=BF=BD=EF=BF=BD=EF=BF=BD F=EF=BF=BD=EF=BF=BDX > >>Bus error (core dumped) > >>localhost# Feb 27 18:20:42 localhost /kernel: pid 86955 (snort_inline), > >>uid 0: exited on signal 10 (core dumped) > >> > >>gdb says: > >>(gdb) core-file snort_inline.core > >>Core was generated by `snort_inline'. > >>Program terminated with signal 10, Bus error. > >>#0 0x281cb2b0 in ?? () > >>(gdb) > >> > >>Any ideas? > >> > >>Thanks! > >> > >>Chris > >> > >>Will Metcalf wrote: > >> > >>>>1) Is ClamAV enabled in a default build of snort_inline? > >>> > >>> > >>>The code is there, but by default it is disabled. To enable > >>>./configure --enable-clamav > >>> > >>> > >>> > >>>>2) How are snort_inline and ClamAV interconnected? ie: is it possibl= e > >>>>to upgrade the ClamAV engine without affecting snort_inline? > >>> > >>> > >>>libclamav, you can upgrade as long as you are going from 0.8x to 0.8y > >>>or 0.7x to 0.7y you need to rebuild if you go from 0.7x to 0.8x > >>> > >>> > >>> > >>>>3) In snort_inline 2.2.0a, how are the virus and IDS signature databa= ses > >>>>re-read after a change? (Send a SIGHUP, restart, etc) > >>> > >>> > >>>SIGHUP or a restart. This is manual, in 2.3.0 you can specify an > >>>interval at which to reread the AV database. You still have to SIGHUP > >>>snort update the signatures. > >>> > >>>Regards, > >>> > >>>Will > >>> > >>>On Sat, 26 Feb 2005 17:55:11 -0500, Christopher Black > >>><bla...@um...> wrote: > >>> > >>> > >>>>Hi all, I have some basic questions about ClamAV support. > >>>> > >>>>1) Is ClamAV enabled in a default build of snort_inline? > >>>>2) How are snort_inline and ClamAV interconnected? ie: is it possibl= e > >>>>to upgrade the ClamAV engine without affecting snort_inline? > >>>>3) In snort_inline 2.2.0a, how are the virus and IDS signature databa= ses > >>>>re-read after a change? (Send a SIGHUP, restart, etc) > >>>> > >>>>Thanks! > >>>> > >>>>Chris > >>>> > >>>> > >>>> > >> > >>-- > >> > >> > >> > > > > >=20 > -- >=20 >=20 > |
|
From: Will M. <wil...@gm...> - 2005-02-28 13:08:37
|
If you are applying the ebtables-brnf patch, the brnf portion of that patch allows iptables to filter on packets passing through the bridge. It doesn't matter if you are using a bridge or using NAT mode, you are still going to use the iptables QUEUE target. As far as I'm aware, ebtables doesn't have anyway to pass packets to userspace. Regards, Will On Mon, 28 Feb 2005 14:37:41 +0800, Yap Sin Hoe <sin...@ex...> wrote: > Hi, > > Sorry I am a new snort user. I'm quite confusing up to this point, by > default, snort_inline will get packets from the iptables, if I create a > bridge and using ebtables, how should I configure the integration between > iptables and ebtables, should I recompile the snort_inline to get packets > from ebtables? Or should I use back the default? > > -----Original Message----- > From: Will Metcalf [mailto:wil...@gm...] > Sent: Monday, February 28, 2005 12:53 PM > To: sin...@ex... > Cc: William Metcalf; sno...@li... > Subject: Re: [Snort-inline-users] Hide interface IP > > > Should I integrate both iptables and ebtables? Where should the > snort_inline > > get packet from? > > It's up to you, snort_inline gets it's packets from iptables. > > On Mon, 28 Feb 2005 12:30:46 +0800, Yap Sin Hoe <sin...@ex...> > wrote: > > > > > > Hi Will, > > > > > > > > Should I integrate both iptables and ebtables? Where should the > snort_inline > > get packet from? > > > > > > ________________________________ > > > > > > From: William Metcalf [mailto:Wil...@kc...] > > Sent: Friday, February 25, 2005 9:47 PM > > To: sin...@ex... > > Cc: sno...@li... > > Subject: RE: [Snort-inline-users] Hide interface IP > > > > > > > > > > if you are running a 2.4.x kernel you need to apply the ebtables-brnf > patch > > and recompile your kernel. > > > > http://ebtables.sourceforge.net/ > > > > Regards, > > > > Will > > "Yap Sin Hoe" <sin...@ex...> > > > > > > > > "Yap Sin Hoe" <sin...@ex...> > > > > 02/25/2005 01:43 AM > > > > > > Please respond to > > <sin...@ex...> > > > > > > > > > > > > > > To > > > > > > "'William Metcalf'" <Wil...@kc...> > > > > > > > > > > cc > > > > > > <sno...@li...> > > > > > > > > > > Subject > > > > > > RE: [Snort-inline-users] Hide interface IP > > > > > > > > > > > > > > > > > > > > > > > > I created the bridge, but all packets are allow to pass through, the > > iptables seem not working anymore. > > > > Please advice. > > ________________________________ > > > > > > From: William Metcalf [mailto:Wil...@kc...] > > Sent: Thursday, February 24, 2005 12:39 PM > > To: sin...@ex... > > Cc: sno...@li... > > Subject: Re: [Snort-inline-users] Hide interface IP > > > > You should create a bridge.... > > > > case "$1" in > > start) > > echo -n "starting bridge" > > #BRIDGE SETUP > > echo setting up bridge > > brctl addbr br0 > > ifconfig eth0 0.0.0.0 up -arp > > ifconfig eth1 0.0.0.0 up -arp > > mii-tool -F 100baseTx-FD eth0 > > mii-tool -F 100baseTx-FD eth1 > > brctl addif br0 eth0 > > brctl addif br0 eth1 > > brctl stp br0 off > > ifconfig br0 0.0.0.0 > > ifconfig br0 up > > sleep 3 > > echo > > ;; > > stop) > > echo -n "Stopping IPS STUFF: (" > > brctl delif br0 eth0 > > brctl delif br0 eth1 > > ifconfig br0 down > > brctl delbr br0 > > echo > > ;; > > restart) > > $0 stop > > $0 start > > ;; > > status) > > status bridge > > ;; > > *) > > echo "Usage: $0 {start|stop|restart|status}" > > exit 1 > > esac > > > > exit 0 > > "Yap Sin Hoe" <sin...@ex...> > > > > > > "Yap Sin Hoe" <sin...@ex...> > > Sent by: sno...@li... > > > > 02/23/2005 09:24 PM > > > > > > Please respond to > > <sin...@ex...> > > > > > > > > > > > > > > To > > > > > > <sno...@li...> > > > > > > > > > > cc > > > > > > > > > > > > > > Subject > > > > > > [Snort-inline-users] Hide interface IP > > > > > > > > > > > > > > > > > > > > > > > > Hi there, > > > > How can I hide the snort_inline interface IP address? Can I run > snort_inline > > in promisc mode (both interfaces) as what snort does, or should I > configure > > Ethernet bridging. Anyone can send me some information or steps? > > > > Best regards, > > shyap > > ------------------------------------------------------- > SF email is sponsored by - The IT Product Guide > Read honest & candid reviews on hundreds of IT Products from real users. > Discover which products truly live up to the hype. Start reading now. > http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click > _______________________________________________ > Snort-inline-users mailing list > Sno...@li... > https://lists.sourceforge.net/lists/listinfo/snort-inline-users > |
|
From: <tha...@gb...> - 2005-02-28 06:48:01
|
Because i wanna test a lot of features so my commands look like : ./configure --prefix=/usr/local/snort_inline-2.3.0-RC1 --enable-perfmonitor --enable-linux-smp-stats --enable-flexresp --enable-clamav --with-mysql --with-postgresql You can check by type a command : ./configure --help > I am ready to install my snort inline box. I am planning to put it behind > my router like you did. I am trying to find some install manuals for > inline > snort but cant find anything. Can you gimme a quick runthrough of how I > should do it? What commands I should add to my ./conifgure statement > (flexresp, mysqpl, etc)? What other things are different with the install > and setup of inline vs regular snort? Are you running clam with inline? > I > took the Sourcefire Snort-2.3.0 and Snort Rules classes, but they did not > go > over inline snort. > > Any help or guidance you can give me is greatly appreciated. > > Thanks, > Peter > > ----- Original Message ----- > From: <tha...@gb...> > To: <sno...@li...> > Sent: Monday, February 28, 2005 12:42 AM > Subject: [Snort-inline-users] Running Snort-inline in which mode should be > better ? > > >> Running Snort-inline in which mode should be better ? >> bettwen bridge mode and nat mode .. >> >> now i'm running my snort-inline with bridge mode and it's work fine for >> me. >> i've place my snort-inline box after my router. >> >> Are there any criterias to concern about choosing bettween bridge and >> nat >> ? >> >> Just wanna share ideas :) >> >> Regards, >> Thanasin >> >> >> >> ------------------------------------------------------- >> SF email is sponsored by - The IT Product Guide >> Read honest & candid reviews on hundreds of IT Products from real users. >> Discover which products truly live up to the hype. Start reading now. >> http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click >> _______________________________________________ >> Snort-inline-users mailing list >> Sno...@li... >> https://lists.sourceforge.net/lists/listinfo/snort-inline-users > > |
|
From: Yap S. H. <sin...@ex...> - 2005-02-28 06:38:05
|
Hi, Sorry I am a new snort user. I'm quite confusing up to this point, by default, snort_inline will get packets from the iptables, if I create a bridge and using ebtables, how should I configure the integration between iptables and ebtables, should I recompile the snort_inline to get packets from ebtables? Or should I use back the default? -----Original Message----- From: Will Metcalf [mailto:wil...@gm...] Sent: Monday, February 28, 2005 12:53 PM To: sin...@ex... Cc: William Metcalf; sno...@li... Subject: Re: [Snort-inline-users] Hide interface IP > Should I integrate both iptables and ebtables? Where should the snort_inline > get packet from? It's up to you, snort_inline gets it's packets from iptables. On Mon, 28 Feb 2005 12:30:46 +0800, Yap Sin Hoe <sin...@ex...> wrote: > > > Hi Will, > > > > Should I integrate both iptables and ebtables? Where should the snort_inline > get packet from? > > > ________________________________ > > > From: William Metcalf [mailto:Wil...@kc...] > Sent: Friday, February 25, 2005 9:47 PM > To: sin...@ex... > Cc: sno...@li... > Subject: RE: [Snort-inline-users] Hide interface IP > > > > > if you are running a 2.4.x kernel you need to apply the ebtables-brnf patch > and recompile your kernel. > > http://ebtables.sourceforge.net/ > > Regards, > > Will > "Yap Sin Hoe" <sin...@ex...> > > > > "Yap Sin Hoe" <sin...@ex...> > > 02/25/2005 01:43 AM > > > Please respond to > <sin...@ex...> > > > > > > > To > > > "'William Metcalf'" <Wil...@kc...> > > > > > cc > > > <sno...@li...> > > > > > Subject > > > RE: [Snort-inline-users] Hide interface IP > > > > > > > > > > > > I created the bridge, but all packets are allow to pass through, the > iptables seem not working anymore. > > Please advice. > ________________________________ > > > From: William Metcalf [mailto:Wil...@kc...] > Sent: Thursday, February 24, 2005 12:39 PM > To: sin...@ex... > Cc: sno...@li... > Subject: Re: [Snort-inline-users] Hide interface IP > > You should create a bridge.... > > case "$1" in > start) > echo -n "starting bridge" > #BRIDGE SETUP > echo setting up bridge > brctl addbr br0 > ifconfig eth0 0.0.0.0 up -arp > ifconfig eth1 0.0.0.0 up -arp > mii-tool -F 100baseTx-FD eth0 > mii-tool -F 100baseTx-FD eth1 > brctl addif br0 eth0 > brctl addif br0 eth1 > brctl stp br0 off > ifconfig br0 0.0.0.0 > ifconfig br0 up > sleep 3 > echo > ;; > stop) > echo -n "Stopping IPS STUFF: (" > brctl delif br0 eth0 > brctl delif br0 eth1 > ifconfig br0 down > brctl delbr br0 > echo > ;; > restart) > $0 stop > $0 start > ;; > status) > status bridge > ;; > *) > echo "Usage: $0 {start|stop|restart|status}" > exit 1 > esac > > exit 0 > "Yap Sin Hoe" <sin...@ex...> > > > "Yap Sin Hoe" <sin...@ex...> > Sent by: sno...@li... > > 02/23/2005 09:24 PM > > > Please respond to > <sin...@ex...> > > > > > > > To > > > <sno...@li...> > > > > > cc > > > > > > > Subject > > > [Snort-inline-users] Hide interface IP > > > > > > > > > > > > Hi there, > > How can I hide the snort_inline interface IP address? Can I run snort_inline > in promisc mode (both interfaces) as what snort does, or should I configure > Ethernet bridging. Anyone can send me some information or steps? > > Best regards, > shyap |
|
From: <tha...@gb...> - 2005-02-28 05:45:09
|
Running Snort-inline in which mode should be better ? bettwen bridge mode and nat mode .. now i'm running my snort-inline with bridge mode and it's work fine for me. i've place my snort-inline box after my router. Are there any criterias to concern about choosing bettween bridge and nat ? Just wanna share ideas :) Regards, Thanasin |
|
From: Christopher B. <bla...@um...> - 2005-02-28 05:34:18
|
Yes sir, that's the configuration it's currently running in on quite a few of our client machines. This is the exact same image, but with the extra flag to configure. Will Metcalf wrote: > Hmmm does it work ok if you don't --enable-clamav? > > Regards, > > Will > On Sun, 27 Feb 2005 18:29:42 -0500, Christopher Black > <bla...@um...> wrote: > >>Excellent information, thank you. >> >>Using snort_inline-2.2.0a and ClamAV 0.8.3, snort_inline crashes >>immediately on boot with this error: >> >>rcmdsh: unknown user: ���$�PjV�s����� F��X >>Bus error (core dumped) >>localhost# Feb 27 18:20:42 localhost /kernel: pid 86955 (snort_inline), >>uid 0: exited on signal 10 (core dumped) >> >>gdb says: >>(gdb) core-file snort_inline.core >>Core was generated by `snort_inline'. >>Program terminated with signal 10, Bus error. >>#0 0x281cb2b0 in ?? () >>(gdb) >> >>Any ideas? >> >>Thanks! >> >>Chris >> >>Will Metcalf wrote: >> >>>>1) Is ClamAV enabled in a default build of snort_inline? >>> >>> >>>The code is there, but by default it is disabled. To enable >>>./configure --enable-clamav >>> >>> >>> >>>>2) How are snort_inline and ClamAV interconnected? ie: is it possible >>>>to upgrade the ClamAV engine without affecting snort_inline? >>> >>> >>>libclamav, you can upgrade as long as you are going from 0.8x to 0.8y >>>or 0.7x to 0.7y you need to rebuild if you go from 0.7x to 0.8x >>> >>> >>> >>>>3) In snort_inline 2.2.0a, how are the virus and IDS signature databases >>>>re-read after a change? (Send a SIGHUP, restart, etc) >>> >>> >>>SIGHUP or a restart. This is manual, in 2.3.0 you can specify an >>>interval at which to reread the AV database. You still have to SIGHUP >>>snort update the signatures. >>> >>>Regards, >>> >>>Will >>> >>>On Sat, 26 Feb 2005 17:55:11 -0500, Christopher Black >>><bla...@um...> wrote: >>> >>> >>>>Hi all, I have some basic questions about ClamAV support. >>>> >>>>1) Is ClamAV enabled in a default build of snort_inline? >>>>2) How are snort_inline and ClamAV interconnected? ie: is it possible >>>>to upgrade the ClamAV engine without affecting snort_inline? >>>>3) In snort_inline 2.2.0a, how are the virus and IDS signature databases >>>>re-read after a change? (Send a SIGHUP, restart, etc) >>>> >>>>Thanks! >>>> >>>>Chris >>>> >>>> >>>> >> >>-- >> >> >> > > -- |
|
From: Will M. <wil...@gm...> - 2005-02-28 05:02:30
|
Hmmm does it work ok if you don't --enable-clamav? Regards, Will On Sun, 27 Feb 2005 18:29:42 -0500, Christopher Black <bla...@um...> wrote: > Excellent information, thank you. >=20 > Using snort_inline-2.2.0a and ClamAV 0.8.3, snort_inline crashes > immediately on boot with this error: >=20 > rcmdsh: unknown user: =EF=BF=BD=EF=BF=BD=EF=BF=BD$=EF=BF=BDPj=04V=EF=BF= =BDs=EF=BF=BD=EF=BF=BD=EF=BF=BD=EF=BF=BD=EF=BF=BD F=EF=BF=BD=EF=BF=BDX > Bus error (core dumped) > localhost# Feb 27 18:20:42 localhost /kernel: pid 86955 (snort_inline), > uid 0: exited on signal 10 (core dumped) >=20 > gdb says: > (gdb) core-file snort_inline.core > Core was generated by `snort_inline'. > Program terminated with signal 10, Bus error. > #0 0x281cb2b0 in ?? () > (gdb) >=20 > Any ideas? >=20 > Thanks! >=20 > Chris >=20 > Will Metcalf wrote: > >>1) Is ClamAV enabled in a default build of snort_inline? > > > > > > The code is there, but by default it is disabled. To enable > > ./configure --enable-clamav > > > > > >>2) How are snort_inline and ClamAV interconnected? ie: is it possible > >>to upgrade the ClamAV engine without affecting snort_inline? > > > > > > libclamav, you can upgrade as long as you are going from 0.8x to 0.8y > > or 0.7x to 0.7y you need to rebuild if you go from 0.7x to 0.8x > > > > > >>3) In snort_inline 2.2.0a, how are the virus and IDS signature database= s > >>re-read after a change? (Send a SIGHUP, restart, etc) > > > > > > SIGHUP or a restart. This is manual, in 2.3.0 you can specify an > > interval at which to reread the AV database. You still have to SIGHUP > > snort update the signatures. > > > > Regards, > > > > Will > > > > On Sat, 26 Feb 2005 17:55:11 -0500, Christopher Black > > <bla...@um...> wrote: > > > >>Hi all, I have some basic questions about ClamAV support. > >> > >>1) Is ClamAV enabled in a default build of snort_inline? > >>2) How are snort_inline and ClamAV interconnected? ie: is it possible > >>to upgrade the ClamAV engine without affecting snort_inline? > >>3) In snort_inline 2.2.0a, how are the virus and IDS signature database= s > >>re-read after a change? (Send a SIGHUP, restart, etc) > >> > >>Thanks! > >> > >>Chris > >> > >> > >> >=20 > -- >=20 >=20 > |
|
From: Will M. <wil...@gm...> - 2005-02-28 04:52:56
|
> Should I integrate both iptables and ebtables? Where should the snort_inline > get packet from? It's up to you, snort_inline gets it's packets from iptables. On Mon, 28 Feb 2005 12:30:46 +0800, Yap Sin Hoe <sin...@ex...> wrote: > > > Hi Will, > > > > Should I integrate both iptables and ebtables? Where should the snort_inline > get packet from? > > > ________________________________ > > > From: William Metcalf [mailto:Wil...@kc...] > Sent: Friday, February 25, 2005 9:47 PM > To: sin...@ex... > Cc: sno...@li... > Subject: RE: [Snort-inline-users] Hide interface IP > > > > > if you are running a 2.4.x kernel you need to apply the ebtables-brnf patch > and recompile your kernel. > > http://ebtables.sourceforge.net/ > > Regards, > > Will > "Yap Sin Hoe" <sin...@ex...> > > > > "Yap Sin Hoe" <sin...@ex...> > > 02/25/2005 01:43 AM > > > Please respond to > <sin...@ex...> > > > > > > > To > > > "'William Metcalf'" <Wil...@kc...> > > > > > cc > > > <sno...@li...> > > > > > Subject > > > RE: [Snort-inline-users] Hide interface IP > > > > > > > > > > > > I created the bridge, but all packets are allow to pass through, the > iptables seem not working anymore. > > Please advice. > ________________________________ > > > From: William Metcalf [mailto:Wil...@kc...] > Sent: Thursday, February 24, 2005 12:39 PM > To: sin...@ex... > Cc: sno...@li... > Subject: Re: [Snort-inline-users] Hide interface IP > > You should create a bridge.... > > case "$1" in > start) > echo -n "starting bridge" > #BRIDGE SETUP > echo setting up bridge > brctl addbr br0 > ifconfig eth0 0.0.0.0 up -arp > ifconfig eth1 0.0.0.0 up -arp > mii-tool -F 100baseTx-FD eth0 > mii-tool -F 100baseTx-FD eth1 > brctl addif br0 eth0 > brctl addif br0 eth1 > brctl stp br0 off > ifconfig br0 0.0.0.0 > ifconfig br0 up > sleep 3 > echo > ;; > stop) > echo -n "Stopping IPS STUFF: (" > brctl delif br0 eth0 > brctl delif br0 eth1 > ifconfig br0 down > brctl delbr br0 > echo > ;; > restart) > $0 stop > $0 start > ;; > status) > status bridge > ;; > *) > echo "Usage: $0 {start|stop|restart|status}" > exit 1 > esac > > exit 0 > "Yap Sin Hoe" <sin...@ex...> > > > "Yap Sin Hoe" <sin...@ex...> > Sent by: sno...@li... > > 02/23/2005 09:24 PM > > > Please respond to > <sin...@ex...> > > > > > > > To > > > <sno...@li...> > > > > > cc > > > > > > > Subject > > > [Snort-inline-users] Hide interface IP > > > > > > > > > > > > Hi there, > > How can I hide the snort_inline interface IP address? Can I run snort_inline > in promisc mode (both interfaces) as what snort does, or should I configure > Ethernet bridging. Anyone can send me some information or steps? > > Best regards, > shyap |
|
From: Christopher B. <bla...@um...> - 2005-02-27 23:30:02
|
Excellent information, thank you. Using snort_inline-2.2.0a and ClamAV 0.8.3, snort_inline crashes immediately on boot with this error: rcmdsh: unknown user: ���$�PjV�s����� F��X Bus error (core dumped) localhost# Feb 27 18:20:42 localhost /kernel: pid 86955 (snort_inline), uid 0: exited on signal 10 (core dumped) gdb says: (gdb) core-file snort_inline.core Core was generated by `snort_inline'. Program terminated with signal 10, Bus error. #0 0x281cb2b0 in ?? () (gdb) Any ideas? Thanks! Chris Will Metcalf wrote: >>1) Is ClamAV enabled in a default build of snort_inline? > > > The code is there, but by default it is disabled. To enable > ./configure --enable-clamav > > >>2) How are snort_inline and ClamAV interconnected? ie: is it possible >>to upgrade the ClamAV engine without affecting snort_inline? > > > libclamav, you can upgrade as long as you are going from 0.8x to 0.8y > or 0.7x to 0.7y you need to rebuild if you go from 0.7x to 0.8x > > >>3) In snort_inline 2.2.0a, how are the virus and IDS signature databases >>re-read after a change? (Send a SIGHUP, restart, etc) > > > SIGHUP or a restart. This is manual, in 2.3.0 you can specify an > interval at which to reread the AV database. You still have to SIGHUP > snort update the signatures. > > Regards, > > Will > > On Sat, 26 Feb 2005 17:55:11 -0500, Christopher Black > <bla...@um...> wrote: > >>Hi all, I have some basic questions about ClamAV support. >> >>1) Is ClamAV enabled in a default build of snort_inline? >>2) How are snort_inline and ClamAV interconnected? ie: is it possible >>to upgrade the ClamAV engine without affecting snort_inline? >>3) In snort_inline 2.2.0a, how are the virus and IDS signature databases >>re-read after a change? (Send a SIGHUP, restart, etc) >> >>Thanks! >> >>Chris >> >> >> -- |
|
From: Will M. <wil...@gm...> - 2005-02-27 03:27:51
|
> 1) Is ClamAV enabled in a default build of snort_inline? The code is there, but by default it is disabled. To enable ./configure --enable-clamav > 2) How are snort_inline and ClamAV interconnected? ie: is it possible > to upgrade the ClamAV engine without affecting snort_inline? libclamav, you can upgrade as long as you are going from 0.8x to 0.8y or 0.7x to 0.7y you need to rebuild if you go from 0.7x to 0.8x > 3) In snort_inline 2.2.0a, how are the virus and IDS signature databases > re-read after a change? (Send a SIGHUP, restart, etc) SIGHUP or a restart. This is manual, in 2.3.0 you can specify an interval at which to reread the AV database. You still have to SIGHUP snort update the signatures. Regards, Will On Sat, 26 Feb 2005 17:55:11 -0500, Christopher Black <bla...@um...> wrote: > Hi all, I have some basic questions about ClamAV support. > > 1) Is ClamAV enabled in a default build of snort_inline? > 2) How are snort_inline and ClamAV interconnected? ie: is it possible > to upgrade the ClamAV engine without affecting snort_inline? > 3) In snort_inline 2.2.0a, how are the virus and IDS signature databases > re-read after a change? (Send a SIGHUP, restart, etc) > > Thanks! > > Chris > > > |
|
From: Christopher B. <bla...@um...> - 2005-02-26 22:55:17
|
Hi all, I have some basic questions about ClamAV support. 1) Is ClamAV enabled in a default build of snort_inline? 2) How are snort_inline and ClamAV interconnected? ie: is it possible to upgrade the ClamAV engine without affecting snort_inline? 3) In snort_inline 2.2.0a, how are the virus and IDS signature databases re-read after a change? (Send a SIGHUP, restart, etc) Thanks! Chris |
|
From: Yap S. H. <sin...@ex...> - 2005-02-24 03:25:16
|
Hi there, How can I hide the snort_inline interface IP address? Can I run snort_inline in promisc mode (both interfaces) as what snort does, or should I configure Ethernet bridging. Anyone can send me some information or steps? Best regards, shyap |
|
From: <tha...@gb...> - 2005-02-24 02:50:48
|
I've a problem about snort-inline to ask. I've installed snort-inline to my network. After plug it, i can see anomally traffic like virus, worm or intrusion detection. Normally, i put it behind my router to see all traffic that went out and come in to my office and it work perfectly. Now, I'm trying to put it in the new place. Putting in front of Domain Controller make every users in my network stuck from loging in to Domain Controller. They can surf webs, read their emails, join irc network or do any downloading from internet so i've no idea where to find the problem. * All of my snort-inline rules are alert and running in bridge mode. This is my IPTables Setting : # # Start IPTables Queue : # echo "Start IPTables Queue Mode ..." /sbin/modprobe ip_queue /sbin/iptables -F /sbin/iptables -A INPUT -i lo -j ACCEPT /sbin/iptables -A OUTPUT -o lo -j ACCEPT /sbin/iptables -A INPUT -i eth0 -j ACCEPT /sbin/iptables -A OUTPUT -o eth0 -j ACCEPT /sbin/iptables -A INPUT -i eth1 -j ACCEPT /sbin/iptables -A OUTPUT -o eth1 -j ACCEPT /sbin/iptables -A INPUT -j QUEUE /sbin/iptables -A OUTPUT -j QUEUE /sbin/iptables -A FORWARD -j QUEUE /sbin/iptables -t mangle -A FORWARD -p tcp --syn -m state --state NEW -j MARK --set-mark 1 /sbin/iptables -t mangle -A FORWARD -p tcp -m state --state RELATED,ESTABLISHED -j MARK --set-mark 2 /sbin/iptables -I FORWARD -m mark --mark 1 -j QUEUE /sbin/iptables -I FORWARD -m mark --mark 2 -j QUEUE Is this relate to IPTables QUEUE problem ? Do you guys have any ideas about this? Regards, Thanasin |
|
From: Bill W. <bw...@op...> - 2005-02-23 20:53:23
|
Here is what I have. Please tell me what I have done wrong. I am not dropping anything. Any ideas? Bill Kernel 2.6.10 Added: Userspace queueing via NETLINK Added: Bridged IP/ARP packets filtering Downloaded and installed Snort-inline 2.3 Ran: ./configure --with-libipq-includes=/usr/include/libipq --enable-inline --enable-clamav *iptables -L * Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination * iptables -A FORWARD -j QUEUE* Came back with nothing * insmod ip_queue* ip_queue 11480 0 * snort_inline -QDc /etc/snort_inline/snort_inline.conf -Q -l /var/log/snort* Reading from iptables Initializing Inline mode Last line of the syslog: Feb 23 15:48:30 wilbur snort_inline: Snort initialization completed successfully (pid=4615) *lsmod* Module Size Used by ip_conntrack_irc 71728 0 ip_conntrack_ftp 72688 0 ipt_LOG 6944 0 bridge 52056 0 iptable_mangle 2720 0 iptable_nat 26984 0 ip_conntrack 47156 3 ip_conntrack_irc,ip_conntrack_ftp,iptable_nat iptable_filter 3584 1 ip_tables 19104 4 ipt_LOG,iptable_mangle,iptable_nat,iptable_filter ipv6 265888 14 af_packet 22472 2 eepro100 30220 0 snd_intel8x0 33216 0 snd_ac97_codec 77056 1 snd_intel8x0 snd_pcm 98248 2 snd_intel8x0,snd_ac97_codec snd_timer 25796 1 snd_pcm snd 56868 4 snd_intel8x0,snd_ac97_codec,snd_pcm,snd_timer snd_page_alloc 9924 2 snd_intel8x0,snd_pcm i2c_i801 8460 0 i2c_core 22736 1 i2c_i801 hw_random 5364 0 pci_hotplug 34448 0 intel_mch_agp 10480 0 intel_agp 22556 1 agpgart 34568 2 intel_mch_agp,intel_agp parport_pc 37956 0 parport 37768 1 parport_pc mousedev 11576 0 tsdev 7648 0 psmouse 21960 0 floppy 60912 0 pcspkr 3464 0 evdev 9504 0 ehci_hcd 33604 0 uhci_hcd 33968 0 usbcore 122520 3 ehci_hcd,uhci_hcd i810_audio 37844 0 ac97_codec 18796 1 i810_audio soundcore 10176 2 snd,i810_audio ata_piix 9092 0 libata 47012 1 ata_piix scsi_mod 130048 1 libata e1000 88628 0 e100 34944 0 mii 4928 2 eepro100,e100 ip_queue 11480 0 ide_cd 42724 0 cdrom 41436 1 ide_cd rtc 12664 0 isofs 36952 0 reiserfs 248528 6 ext3 140168 1 jbd 61976 1 ext3 ide_generic 1056 0 [permanent] siimage 12512 0 [permanent] aec62xx 7264 0 [permanent] trm290 4196 0 [permanent] alim15x3 10572 0 [permanent] hpt34x 5152 0 [permanent] hpt366 20128 0 [permanent] ide_disk 21024 10 hpt366 cmd64x 11964 0 [permanent] piix 10116 0 [permanent] rz1000 2432 0 [permanent] slc90e66 5568 0 [permanent] generic 3904 0 [permanent] cs5530 4608 0 [permanent] cs5520 4576 0 [permanent] sc1200 7136 0 [permanent] triflex 3584 0 [permanent] atiixp 5968 0 [permanent] pdc202xx_old 11200 0 [permanent] pdc202xx_new 8928 0 [permanent] opti621 4452 0 [permanent] ns87415 3656 0 [permanent] cy82c693 4416 0 [permanent] amd74xx 12956 0 [permanent] sis5513 14472 0 [permanent] via82cxxx 12220 0 [permanent] serverworks 7592 0 [permanent] ide_core 130512 28 ide_cd,ide_generic,siimage,aec62xx,trm290,alim15x3,hpt34x,hpt366,ide_disk,cmd64x,piix,rz1000,slc90e66,generic,cs5530,cs5520,sc1200,triflex,atiixp,pdc202xx_old,pdc202xx_new,opti621,ns87415,cy82c693,amd74xx,sis5513,via82cxxx,serverworks unix 28820 14 -- ********************************** Bill Warren Optivel, Inc. E-mail: bw...@op... Voice: 317.275.2305 Fax: 317.275.2301 Web: http://www.optivel.com ********************************** |
|
From: Jason <sec...@br...> - 2005-02-23 03:45:26
|
Richard Compton wrote: > I know that certain commercial IPSs like Proventia have ethernet > interfaces with a relay that fail open when the power is disconnected > to them. Maybe you could use interfaces like this in your IPS. > If you are going to go commercial http://www.sourcefire.com/products/is.html |
|
From: Nick R. <ni...@ro...> - 2005-02-23 00:48:06
|
On Mon, 21 Feb 2005, Richard Compton wrote: > I know that certain commercial IPSs like Proventia have ethernet > interfaces with a relay that fail open when the power is disconnected to > them. Maybe you could use interfaces like this in your IPS. Run two firewalls talking free-VRRP. It seems to work OK and will provide this feature of having a standby. Nick Rogness <ni...@ro...> - How many people here have telekenetic powers? Raise my hand. -Emo Philips |
|
From: Yap S. H. <sin...@ex...> - 2005-02-22 08:50:11
|
Hi Chris, Sound good. Do you have any contact or information? -----Original Message----- From: Christopher Black [mailto:bla...@um...] Sent: Tuesday, February 22, 2005 12:59 PM To: Richard Compton Cc: sin...@ex...; Will Metcalf; sno...@li... Subject: Re: [Snort-inline-users] Help- Snort_inline Single Point of Failure There are small integrated computers made by IBT out of Canada that have this feature. They are roughly $300 for a 1ghz passively cooled box with 128mb RAM, 4 10/100 NICs, and a 20gb hard drive. The first two NICs on the board have relays that fail to closed acting as a pass-through when the box loses power. Overall the boxes are extremely well-made, and I can recommend them heartily. Richard Compton wrote: > I know that certain commercial IPSs like Proventia have ethernet > interfaces with a relay that fail open when the power is disconnected > to them. Maybe you could use interfaces like this in your IPS. > > > On Tue, 22 Feb 2005 10:48:42 +0800, Yap Sin Hoe <sin...@ex...> wrote: > >>Hi Will, >> >>I agree what you are saying, but in certain circumstances when budget is a >>concern for customer, then we need to work out a solution to fix the budget >>as well as to minimize the downtime. >> >>Is there a way other than having another redundant box, Snort_inline can >>still allow traffic to pass in the event of power loss or other failures? >> >>regards >> >>-----Original Message----- >>From: Will Metcalf [mailto:wil...@gm...] >>Sent: Tuesday, February 22, 2005 1:45 AM >>To: sin...@ex... >>Cc: sno...@li... >>Subject: Re: [Snort-inline-users] Help- Snort_inline Single Point of Failure >> >>Not really sure what you are asking me here. Are you asking me if a >>box running snort-inline dies how to get traffic to pass? The short >>answer is if you don't have redundent connections to whatever network >>segment you are trying to protect you can't do this. This isn't a >>snort-inline limitation though, this is a network design limitation. >> >>Regards, >> >>Will >> >>On Mon, 21 Feb 2005 11:59:30 +0800, Yap Sin Hoe <sin...@ex...> >>wrote: >> >>> >>> >>>Is snort-inline a single point of failure when the box facing hardware >>>failure, for example power supply problem. Any idea how to solve this? >>> >>> >>> >>> >>>Best regards, >>> >>>Shyap >>> >>> >>> >>> >> >>------------------------------------------------------- >>SF email is sponsored by - The IT Product Guide >>Read honest & candid reviews on hundreds of IT Products from real users. >>Discover which products truly live up to the hype. Start reading now. >>http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click >>_______________________________________________ >>Snort-inline-users mailing list >>Sno...@li... >>https://lists.sourceforge.net/lists/listinfo/snort-inline-users >> > > > |
|
From: Christopher B. <bla...@um...> - 2005-02-22 04:57:22
|
There are small integrated computers made by IBT out of Canada that have this feature. They are roughly $300 for a 1ghz passively cooled box with 128mb RAM, 4 10/100 NICs, and a 20gb hard drive. The first two NICs on the board have relays that fail to closed acting as a pass-through when the box loses power. Overall the boxes are extremely well-made, and I can recommend them heartily. Richard Compton wrote: > I know that certain commercial IPSs like Proventia have ethernet > interfaces with a relay that fail open when the power is disconnected > to them. Maybe you could use interfaces like this in your IPS. > > > On Tue, 22 Feb 2005 10:48:42 +0800, Yap Sin Hoe <sin...@ex...> wrote: > >>Hi Will, >> >>I agree what you are saying, but in certain circumstances when budget is a >>concern for customer, then we need to work out a solution to fix the budget >>as well as to minimize the downtime. >> >>Is there a way other than having another redundant box, Snort_inline can >>still allow traffic to pass in the event of power loss or other failures? >> >>regards >> >>-----Original Message----- >>From: Will Metcalf [mailto:wil...@gm...] >>Sent: Tuesday, February 22, 2005 1:45 AM >>To: sin...@ex... >>Cc: sno...@li... >>Subject: Re: [Snort-inline-users] Help- Snort_inline Single Point of Failure >> >>Not really sure what you are asking me here. Are you asking me if a >>box running snort-inline dies how to get traffic to pass? The short >>answer is if you don't have redundent connections to whatever network >>segment you are trying to protect you can't do this. This isn't a >>snort-inline limitation though, this is a network design limitation. >> >>Regards, >> >>Will >> >>On Mon, 21 Feb 2005 11:59:30 +0800, Yap Sin Hoe <sin...@ex...> >>wrote: >> >>> >>> >>>Is snort-inline a single point of failure when the box facing hardware >>>failure, for example power supply problem. Any idea how to solve this? >>> >>> >>> >>> >>>Best regards, >>> >>>Shyap >>> >>> >>> >>> >> >>------------------------------------------------------- >>SF email is sponsored by - The IT Product Guide >>Read honest & candid reviews on hundreds of IT Products from real users. >>Discover which products truly live up to the hype. Start reading now. >>http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click >>_______________________________________________ >>Snort-inline-users mailing list >>Sno...@li... >>https://lists.sourceforge.net/lists/listinfo/snort-inline-users >> > > > |
|
From: Richard C. <ric...@gm...> - 2005-02-22 04:43:37
|
I know that certain commercial IPSs like Proventia have ethernet interfaces with a relay that fail open when the power is disconnected to them. Maybe you could use interfaces like this in your IPS. On Tue, 22 Feb 2005 10:48:42 +0800, Yap Sin Hoe <sin...@ex...> wrote: > Hi Will, > > I agree what you are saying, but in certain circumstances when budget is a > concern for customer, then we need to work out a solution to fix the budget > as well as to minimize the downtime. > > Is there a way other than having another redundant box, Snort_inline can > still allow traffic to pass in the event of power loss or other failures? > > regards > > -----Original Message----- > From: Will Metcalf [mailto:wil...@gm...] > Sent: Tuesday, February 22, 2005 1:45 AM > To: sin...@ex... > Cc: sno...@li... > Subject: Re: [Snort-inline-users] Help- Snort_inline Single Point of Failure > > Not really sure what you are asking me here. Are you asking me if a > box running snort-inline dies how to get traffic to pass? The short > answer is if you don't have redundent connections to whatever network > segment you are trying to protect you can't do this. This isn't a > snort-inline limitation though, this is a network design limitation. > > Regards, > > Will > > On Mon, 21 Feb 2005 11:59:30 +0800, Yap Sin Hoe <sin...@ex...> > wrote: > > > > > > > > Is snort-inline a single point of failure when the box facing hardware > > failure, for example power supply problem. Any idea how to solve this? > > > > > > > > > > Best regards, > > > > Shyap > > > > > > > > > > ------------------------------------------------------- > SF email is sponsored by - The IT Product Guide > Read honest & candid reviews on hundreds of IT Products from real users. > Discover which products truly live up to the hype. Start reading now. > http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click > _______________________________________________ > Snort-inline-users mailing list > Sno...@li... > https://lists.sourceforge.net/lists/listinfo/snort-inline-users > -- Thanks, Rich Compton |
|
From: Yap S. H. <sin...@ex...> - 2005-02-22 02:48:51
|
Hi Will, I agree what you are saying, but in certain circumstances when budget is a concern for customer, then we need to work out a solution to fix the budget as well as to minimize the downtime. Is there a way other than having another redundant box, Snort_inline can still allow traffic to pass in the event of power loss or other failures? regards -----Original Message----- From: Will Metcalf [mailto:wil...@gm...] Sent: Tuesday, February 22, 2005 1:45 AM To: sin...@ex... Cc: sno...@li... Subject: Re: [Snort-inline-users] Help- Snort_inline Single Point of Failure Not really sure what you are asking me here. Are you asking me if a box running snort-inline dies how to get traffic to pass? The short answer is if you don't have redundent connections to whatever network segment you are trying to protect you can't do this. This isn't a snort-inline limitation though, this is a network design limitation. Regards, Will On Mon, 21 Feb 2005 11:59:30 +0800, Yap Sin Hoe <sin...@ex...> wrote: > > > > Is snort-inline a single point of failure when the box facing hardware > failure, for example power supply problem. Any idea how to solve this? > > > > > Best regards, > > Shyap > > > > |
|
From: Will M. <wil...@gm...> - 2005-02-21 17:45:09
|
Not really sure what you are asking me here. Are you asking me if a box running snort-inline dies how to get traffic to pass? The short answer is if you don't have redundent connections to whatever network segment you are trying to protect you can't do this. This isn't a snort-inline limitation though, this is a network design limitation. Regards, Will On Mon, 21 Feb 2005 11:59:30 +0800, Yap Sin Hoe <sin...@ex...> wrote: > > > > Is snort-inline a single point of failure when the box facing hardware > failure, for example power supply problem. Any idea how to solve this? > > > > > Best regards, > > Shyap > > > > |
|
From: Yap S. H. <sin...@ex...> - 2005-02-21 03:59:40
|
Is snort-inline a single point of failure when the box facing hardware failure, for example power supply problem. Any idea how to solve this? Best regards, Shyap |
|
From: <bw...@op...> - 2005-02-18 16:31:10
|
I am going to be running in bridge mode. After I do a make menuconfig, what is the path to the spave queueing? Bill > > > > Depends on if you are running in bridge mode or NAT mode. But > basically if you want to cover all of your bases, make sure that > bridging and user space queueing are turned on, along with all of the > other netfilter goodies you want. They integrated ebtables and brnf > code into 2.6 so you no longer need those patches for running in bridge > mode. > > Regards, > > Will > > > > <bwarren@optivel. > com> > > = To > > 02/18/2005 10:18 <Wil...@kc...>, > AM > <sno...@li...urcefor > ge.net> > > = cc > > > Subje= ct > > Kernel 2.6 and Snort-inline 2.3 > What needs turned on > > > > > > > > > > > > What in kernel 2.6 needs to be turned on and what needs to be turned > off for Snort-inline 2.3 to work correctly? > Thanks, > Bill |
|
From: <bw...@op...> - 2005-02-18 16:18:42
|
What in kernel 2.6 needs to be turned on and what needs to be turned off for Snort-inline 2.3 to work correctly? Thanks, Bill |
133 messages has been excluded from this view by a project administrator.
