Re: [Snort-users] send flex-resp through interface which has no ip-address!?

Hiya Elmar,
I had to solve this issue yesterday.  Well, maybe not solve, but I got a 
funky work-around going.
The way I got it working was by assigning an IP that was invalid for the 
network to the previously IP-less interface (I essentially told the OS 
that the CIDR net was a little larger than it really was, then assigned 
an IP just outside of the legal range for that network to the 
interface), then adding an entry for the network's default gateway to 
the routing table.
This isn't perfect; hosts within my "expanded" CIDR net, but that are 
actually remote, will never get RSTs, but it has the benefit of snort 
still being somewhat transparent to scans (at least remotely), and 
getting those RSTs where they need to go.

- Ramon

Elmar Bschorer wrote:

> how can i manage, that snort sends felxible resps through e.g. eth0
> which has no ip-address assigned!?
>  


-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users