snort-inline-users

[Snort-inline-users] Query

[aparna m. <apa...@ya...>]

hello ,
  I am doing a small project in networking . I want to
compress packets at server side and then send it to
the receiver where it will be decompressed.My problem
is where to capture packets and modify it.Snort helps
in capturing packets but does it support any feature
that allows me to change contents of packets.

I am really stuck up at this point .Any help will be
appreciated.

Thanks.


		
__________________________________________________________ 
Yahoo! India Matrimony: Find your partner now. Go to http://yahoo.shaadi.com

Re: [Snort-inline-users] Query

[Will M. <wil...@gm...>]

Ummmm you can replace payload contents (see the README.INLINE) but the
p->dsize has to be the same as the original packet, so I don't think
this is going to help you at all.

Regards,

Will

On 2/16/06, aparna misri <apa...@ya...> wrote:
> hello ,
>   I am doing a small project in networking . I want to
> compress packets at server side and then send it to
> the receiver where it will be decompressed.My problem
> is where to capture packets and modify it.Snort helps
> in capturing packets but does it support any feature
> that allows me to change contents of packets.
>
> I am really stuck up at this point .Any help will be
> appreciated.
>
> Thanks.
>
>
>
> __________________________________________________________
> Yahoo! India Matrimony: Find your partner now. Go to http://yahoo.shaadi.=
com
>
>
> -------------------------------------------------------
> This SF.net email is sponsored by: Splunk Inc. Do you grep through log fi=
les
> for problems?  Stop!  Download the new AJAX search engine that makes
> searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
> http://sel.as-us.falkag.net/sel?cmd=3Dlnk&kid=3D103432&bid=3D230486&dat=
=3D121642
> _______________________________________________
> Snort-inline-users mailing list
> Sno...@li...
> https://lists.sourceforge.net/lists/listinfo/snort-inline-users
>

Re: [Snort-inline-users] Query

[Nick R. <ni...@ro...>]

> hello ,
>   I am doing a small project in networking . I want to
> compress packets at server side and then send it to
> the receiver where it will be decompressed.My problem
> is where to capture packets and modify it.Snort helps
> in capturing packets but does it support any feature
> that allows me to change contents of packets.
>
> I am really stuck up at this point .Any help will be
> appreciated.
>

  Snort_inline is not built for this type of functionality.  Even if you
did add a compression plugin, you would be disappointed in the speed due
to the overhead.  You should be using client-server model software for
something like this.  I would suggest:

  - Build a kernel module (like Netgraph)
  - Modify a tunnelling technology like GRE/IPIP
  - Look for existing apps that already do this (search google).

FWIW,

Nick Rogness <ni...@ro...>

Re: [Snort-inline-users] Query

[C.G.Senthilkumar. <che...@cs...>]

Would using a firewall like iptables or ipfw help? You could
divert packets to a user process, modify and re-inject it.

For effeciency purposes, one could directly make use of the
netfilter's libipt. Would this help?

My 2 cents.
Senthil.

On Fri, 17 Feb 2006, Nick Rogness wrote:

>
>> hello ,
>>   I am doing a small project in networking . I want to
>> compress packets at server side and then send it to
>> the receiver where it will be decompressed.My problem
>> is where to capture packets and modify it.Snort helps
>> in capturing packets but does it support any feature
>> that allows me to change contents of packets.
>>
>> I am really stuck up at this point .Any help will be
>> appreciated.
>>
>
>  Snort_inline is not built for this type of functionality.  Even if you
> did add a compression plugin, you would be disappointed in the speed due
> to the overhead.  You should be using client-server model software for
> something like this.  I would suggest:
>
>  - Build a kernel module (like Netgraph)
>  - Modify a tunnelling technology like GRE/IPIP
>  - Look for existing apps that already do this (search google).
>
> FWIW,
>
> Nick Rogness <ni...@ro...>
>
>
>
> -------------------------------------------------------
> This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
> for problems?  Stop!  Download the new AJAX search engine that makes
> searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
> http://sel.as-us.falkag.net/sel?cmd=lnk&kid=103432&bid=230486&dat=121642
> _______________________________________________
> Snort-inline-users mailing list
> Sno...@li...
> https://lists.sourceforge.net/lists/listinfo/snort-inline-users
>

-- 
Today's fortune:
If the automobile had followed the same development as the computer, a
Rolls-Royce would today cost $100, get a million miles per per gallon,
and explode once a year killing everyone inside.
 		-- Robert Cringely, InfoWorld

Re: [Snort-inline-users] Query

[Murali R. <pro...@gm...>]

U25vcnRfaW5saW5lIGlzIHByb2JhYmx5IG5vdCB3aGF0IHlvdSBhcmUgbG9va2luZyBmb3IuIFBl
cmhhcHMgdGFrZSBhCmxvb2sgYXQgc2V0dGluZyB1cCBTU0ggdHVuIChPcGVuU1NIIDQuMykgYW5k
IGFsc28gdXNlIHRoZSBzc2ggLUMgZm9yCmNvbXByZXNzaW9uPwoKaHR0cDovL3d3dy5vcGVuYnNk
Lm9yZy9jZ2ktYmluL21hbi5jZ2k/cXVlcnk9c3NoZCZhcHJvcG9zPTAmc2VrdGlvbj0wJm1hbnBh
dGg9T3BlbkJTRCtDdXJyZW50JmFyY2g9aTM4NiZmb3JtYXQ9aHRtbAoKaHR0cDovL3d3dy5vcGVu
YnNkLm9yZy9jZ2ktYmluL21hbi5jZ2k/cXVlcnk9c3NoJmFwcm9wb3M9MCZzZWt0aW9uPTAmbWFu
cGF0aD1PcGVuQlNEK0N1cnJlbnQmYXJjaD1pMzg2JmZvcm1hdD1odG1sCgpSZWdhcmRzLAoKX1Jh
anUKCk9uIDIvMTYvMDYsIGFwYXJuYSBtaXNyaSA8YXBhcm5hbWlzcmkwNUB5YWhvby5jby5pbj4g
d3JvdGU6Cj4gaGVsbG8gLAo+ICAgSSBhbSBkb2luZyBhIHNtYWxsIHByb2plY3QgaW4gbmV0d29y
a2luZyAuIEkgd2FudCB0bwo+IGNvbXByZXNzIHBhY2tldHMgYXQgc2VydmVyIHNpZGUgYW5kIHRo
ZW4gc2VuZCBpdCB0bwo+IHRoZSByZWNlaXZlciB3aGVyZSBpdCB3aWxsIGJlIGRlY29tcHJlc3Nl
ZC5NeSBwcm9ibGVtCj4gaXMgd2hlcmUgdG8gY2FwdHVyZSBwYWNrZXRzIGFuZCBtb2RpZnkgaXQu
U25vcnQgaGVscHMKPiBpbiBjYXB0dXJpbmcgcGFja2V0cyBidXQgZG9lcyBpdCBzdXBwb3J0IGFu
eSBmZWF0dXJlCj4gdGhhdCBhbGxvd3MgbWUgdG8gY2hhbmdlIGNvbnRlbnRzIG9mIHBhY2tldHMu
Cj4KPiBJIGFtIHJlYWxseSBzdHVjayB1cCBhdCB0aGlzIHBvaW50IC5BbnkgaGVscCB3aWxsIGJl
Cj4gYXBwcmVjaWF0ZWQuCj4KPiBUaGFua3MuCj4KPgo+Cj4gX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwo+IFlhaG9vISBJbmRpYSBNYXRy
aW1vbnk6IEZpbmQgeW91ciBwYXJ0bmVyIG5vdy4gR28gdG8gaHR0cDovL3lhaG9vLnNoYWFkaS5j
b20KPgo+Cj4gLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
LS0tLS0tLQo+IFRoaXMgU0YubmV0IGVtYWlsIGlzIHNwb25zb3JlZCBieTogU3BsdW5rIEluYy4g
RG8geW91IGdyZXAgdGhyb3VnaCBsb2cgZmlsZXMKPiBmb3IgcHJvYmxlbXM/ICBTdG9wISAgRG93
bmxvYWQgdGhlIG5ldyBBSkFYIHNlYXJjaCBlbmdpbmUgdGhhdCBtYWtlcwo+IHNlYXJjaGluZyB5
b3VyIGxvZyBmaWxlcyBhcyBlYXN5IGFzIHN1cmZpbmcgdGhlICB3ZWIuICBET1dOTE9BRCBTUExV
TkshCj4gaHR0cDovL3NlbC5hcy11cy5mYWxrYWcubmV0L3NlbD9jbWQ9bG5rJmtpZD0xMDM0MzIm
YmlkPTIzMDQ4NiZkYXQ9MTIxNjQyCj4gX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX18KPiBTbm9ydC1pbmxpbmUtdXNlcnMgbWFpbGluZyBsaXN0Cj4gU25vcnQt
aW5saW5lLXVzZXJzQGxpc3RzLnNvdXJjZWZvcmdlLm5ldAo+IGh0dHBzOi8vbGlzdHMuc291cmNl
Zm9yZ2UubmV0L2xpc3RzL2xpc3RpbmZvL3Nub3J0LWlubGluZS11c2Vycwo+CgoKLS0KTWF5IHRo
ZSBwYWNrZXRzIGJlIHdpdGggeW91Lgo=