That's a cool thing to play around. But right now I'm only studying plugins
or modules for Snort. The slow down functionality was only one I example I
thought, but it seems not to make sense in a IDS. I'm concentrating right
now in developing one or two demos with flexresp.
Thanks,
-pfeito
-----Original Message-----
From: Jim Hendrick [mailto:jrhendri@maine.rr.com]
Sent: domingo, 29 de Agosto de 2004 21:22
To: 'pfeito'; snort-users@lists.sourceforge.net
Subject: RE: [Snort-users] Slow down TCP connections
If you are looking to slow down scans, try a tarpit (e.g. labrea)
flexrsp is really designed to reset TCP connections to halt an attack.
-----Original Message-----
From: snort-users-admin@lists.sourceforge.net
[mailto:snort-users-admin@lists.sourceforge.net] On Behalf Of pfeito
Sent: Sunday, August 29, 2004 12:57 PM
To: snort-users@lists.sourceforge.net
Subject: [Snort-users] Slow down TCP connections
Hi Guys,
I'm searching for pro-active plug-ins for Snort.
Right know, I've just compiled and installed snort 2.2.0 with flexresp2
support. I'm about to test flexresp2 capabilities, but It seems to have no
support for slowing down TCP connections (i.e. for slowing down TCP Scans
for instance...)
Do you know any plug-in that allows Snort to slow down TCP connections
speed
(i.e. resize TCP window size) ?
Thanks,
-pfeito
-------------------------------------------------------
This SF.Net email is sponsored by BEA Weblogic Workshop
FREE Java Enterprise J2EE developer tools!
Get your free copy of BEA WebLogic Workshop 8.1 today.
http://ads.osdn.com/?ad_id=5047&alloc_id=10808&op=click
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
-------------------------------------------------------
This SF.Net email is sponsored by BEA Weblogic Workshop
FREE Java Enterprise J2EE developer tools!
Get your free copy of BEA WebLogic Workshop 8.1 today.
http://ads.osdn.com/?ad_id=5047&alloc_id=10808&op=click
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
