I don't really have a final purpose, I'm just digging out what proactive
stuff there is out there for Snort.
I don't need it, I just thought of it, as an example of proactive
functionality and wanted to find out if there is such thing. I guess it is
kind of stupid.... although it could be useful in an snort+honeypot
scenario. Don't really put much though in it.
Why are you seeking and IDS to do traffic queueing ?
No. That would be like trying to cut a steak with a spoon :P !
-----Original Message-----
From: snort-users-admin@lists.sourceforge.net [mailto:snort-users-
admin@lists.sourceforge.net] On Behalf Of Keith W. McCammon
Sent: domingo, 29 de Agosto de 2004 18:14
To: snort-users@lists.sourceforge.net
Subject: Re: [Snort-users] Slow down TCP connections
Right know, I've just compiled and installed snort 2.2.0 with flexresp2
support. I'm about to test flexresp2 capabilities, but It seems to have
no
support for slowing down TCP connections (i.e. for slowing down TCP
Scans
for instance...)
Why would Snort want to "slow down" a TCP scan? Snort will catch it,
and under certain circumstances, flexresp2 can reset those
connections. That's pretty much the extent of Snort's involvement.
Do you know any plug-in that allows Snort to slow down TCP connections
speed
(i.e. resize TCP window size) ?
No. What would you accomplish by doing this? Either block the
traffic or don't. Slowing it down won't really get you anywhere
(it'll just take the attacker longer to do the same thing).
-------------------------------------------------------
This SF.Net email is sponsored by BEA Weblogic Workshop
FREE Java Enterprise J2EE developer tools!
Get your free copy of BEA WebLogic Workshop 8.1 today.
http://ads.osdn.com/?ad_id=5047&alloc_id=10808&op=click
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
-------------------------------------------------------
This SF.Net email is sponsored by BEA Weblogic Workshop
FREE Java Enterprise J2EE developer tools!
Get your free copy of BEA WebLogic Workshop 8.1 today.
http://ads.osdn.com/?ad_id=5047&alloc_id=10808&op=click
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
