snort-inline-users

[Snort-inline-users] Running Snort-inline in which mode should be better ?

[<tha...@gb...>]

Running Snort-inline in which mode should be better ?
bettwen bridge mode and nat mode ..

now i'm running my snort-inline with bridge mode and it's work fine for me.
i've place my snort-inline box after my router.

Are there any criterias to concern about choosing bettween bridge and nat ?

Just wanna share ideas :)

Regards,
Thanasin

Re: [Snort-inline-users] Running Snort-inline in which mode should be better ?

[<tha...@gb...>]

Because i wanna test a lot of features so my commands look like :

./configure --prefix=/usr/local/snort_inline-2.3.0-RC1
--enable-perfmonitor --enable-linux-smp-stats --enable-flexresp
--enable-clamav --with-mysql --with-postgresql

You can check by type a command : ./configure --help

> I am ready to install my snort inline box.  I am planning to put it behind
> my router like you did.  I am trying to find some install manuals for
> inline
> snort but cant find anything.  Can you gimme a quick runthrough of how I
> should do it?  What commands I should add to my ./conifgure statement
> (flexresp, mysqpl, etc)?  What other things are different with the install
> and setup of inline vs regular snort?  Are you running clam with inline?
> I
> took the Sourcefire Snort-2.3.0 and Snort Rules classes, but they did not
> go
> over inline snort.
>
> Any help or guidance you can give me is greatly appreciated.
>
> Thanks,
> Peter
>
> ----- Original Message -----
> From: <tha...@gb...>
> To: <sno...@li...>
> Sent: Monday, February 28, 2005 12:42 AM
> Subject: [Snort-inline-users] Running Snort-inline in which mode should be
> better ?
>
>
>> Running Snort-inline in which mode should be better ?
>> bettwen bridge mode and nat mode ..
>>
>> now i'm running my snort-inline with bridge mode and it's work fine for
>> me.
>> i've place my snort-inline box after my router.
>>
>> Are there any criterias to concern about choosing bettween bridge and
>> nat
>> ?
>>
>> Just wanna share ideas :)
>>
>> Regards,
>> Thanasin
>>
>>
>>
>> -------------------------------------------------------
>> SF email is sponsored by - The IT Product Guide
>> Read honest & candid reviews on hundreds of IT Products from real users.
>> Discover which products truly live up to the hype. Start reading now.
>> http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
>> _______________________________________________
>> Snort-inline-users mailing list
>> Sno...@li...
>> https://lists.sourceforge.net/lists/listinfo/snort-inline-users
>
>

Re: [Snort-inline-users] Running Snort-inline in which mode should be better ?

[Richard C. <ric...@gm...>]

Running an IPS in bridge mode is more secure because your interfaces
that are blocking the traffic do not have IP addresses associated with
them which makes it difficult for a hacker to see your IPS in line
much less attack it.  Most IPSs run in bridge mode so I would suggest
keeping this configuration.  You can do your NAT on your router or
other network device.

-Rich


On Mon, 28 Feb 2005 12:42:56 +0700 (ICT), tha...@gb...
<tha...@gb...> wrote:
> Running Snort-inline in which mode should be better ?
> bettwen bridge mode and nat mode ..
> 
> now i'm running my snort-inline with bridge mode and it's work fine for me.
> i've place my snort-inline box after my router.
> 
> Are there any criterias to concern about choosing bettween bridge and nat ?
> 
> Just wanna share ideas :)
> 
> Regards,
> Thanasin
> 
> -------------------------------------------------------
> SF email is sponsored by - The IT Product Guide
> Read honest & candid reviews on hundreds of IT Products from real users.
> Discover which products truly live up to the hype. Start reading now.
> http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
> _______________________________________________
> Snort-inline-users mailing list
> Sno...@li...
> https://lists.sourceforge.net/lists/listinfo/snort-inline-users
> 


-- 
Thanks,
Rich Compton