At 02:04 PM 12/23/2004, mdpeters wrote:
Do I need to enable ip_forwarding on for the transparent bridge to work?
As I understand it, you explicitly MUST NOT enable ip_forwarding, otherwise
your snort-inline is a "pass all".
Do I need to install ebtables for inline to disrupt traffic or is
iptables, libnet, and libpcap all that I might need?
AFAIK you don't need ebtables. You do need libipq for inline and libnet.
This is how snort-inline attaches to iptables by using libipq instead of
using libpcap.
It is my impression that iptables just firewalls with static rules.
On it's own, yes, but IPTables is VERY extensible via libipq..
That's where snort-inline comes in. Snort-inline interacts with iptables.
It doesn't do things like create iptables rules to block packets, it the
whole system becomes an iptables rule, it just happens to be a rule that
runs snort instead of some simple expression.
Do the snort rules running on the transparent inline snort box reset the
traffic that passes through using inline?
Depends on if you use DROP or SDROP :).. However, inline doesn't JUST reset
the traffic.. it also prevents the packet from being forwarded at all. DROP
will also reset, SDROP won't.
Snort 2.3's inline capacity is a direct port of snort-inline. You might
want to check their FAQ for other info:
http://snort-inline.sourceforge.net/FAQ.html
-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://productguide.itmanagersjournal.com/
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
