similar to: snort inline and imq

Hi All, I am adding ip_queue module for snort inline IDS. I am using snort2.4.0 And iptables-1.3.4. Userspace Queuing(queue target) is enabled. It is built-in and not built as a module. The output of /proc/net/ip_queue is shown below: cat /proc/net/ip_queue> Peer PID : 0 Copy mode : 0 Copy range : 0 Queue length : 0 Queue max. length : 1024 IPTABLES 1.3.4 is

Trying to use the policy drop rule with the bridged firewall, when I removed the first line the transparent proxy works great? It seems a bit strange as from reading several articles on it I thought the following occurs. 1st line - if it doest match it gets dropped on the local filter input. 2nd line - redirects the traffic off the link layer into the network layer ready for line 3. 3rd line -

Question to the list, Has anyone here had experience using Shorewall (multi-isp configuration) with Snort inline? First, is this possible? Second, if anyone has done this, what documentation, if any did they use to set it up? Third, does snort have to run inline on a firewall (I''m under the impression it does)?

I made an atempt to run snort_inline and shorewall on the same system but I could not get snort to see the packets. Maybe someone with a little more iptables knowledge could tell me what I''m doing wrong or if its possible to have the systems setup so that it places packets that the firewall would allow into QUEUE. After setting up and starting shorewall I then issue the following

Hello , I am trying to compile ctdb. I pull latest version 2-Jun-2009. During make it fails with error: Compiling utils/ipmux/ipmux.c In file included from /usr/include/linux/netfilter_ipv4/ip_queue.h:10, from /usr/include/libipq.h:37, from utils/ipmux/ipmux.c:31: /usr/include/linux/if.h:59: error: redefinition of `struct ifmap' /usr/include/linux/if.h:77:

Is IFB realy replacement of IMQ Please Guide -- Failure seldom stops you. What stops you is the fear of failure. _______________________________________________ LARTC mailing list LARTC@mailman.ds9a.nl http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

Hi, I''m trying to configure IMQ to work on the same machine with frottle (http://frottle.sourceforge.net). The problem is both feed themselves packets through netfilter queueing mechanism, but currently there can only be one netfilter queue per protocol family. To explain why I need IMQ in the first place I have to explain what frottle does. It is a deamon that tweaks the behaviour of a

Dear all, I''m setting up a new gateway for a small network (under 30 users)Gw will host the following services:shorewalldnsproxy i''m considering installing snort.can i do so on the same exact box ? is there any security risk of doing so ? box would have 4 ISPs and two internal interfaces. Any recommendation about the optimal setup of snort and shorewall (or if you suggest

Hello all: I tried to install snort under /usr/ports/security and have some problems. with "make all", I checked every item on the menu but I got error messages: ////////////////////////////// laptop# make all ===> snort-2.8.1_1 is marked as broken: FLEXRESP2 patch file does not incorporate cleanly. *** Error code 1 Stop in /usr/ports/security/snort.

https://bugzilla.netfilter.org/cgi-bin/bugzilla/show_bug.cgi?id=39 Summary: can't execute 'make modules' Product: netfilter/iptables Version: patch-o-matic Platform: i386 OS/Version: RedHat Linux Status: NEW Severity: major Priority: P2 Component: ip_tables (kernel) AssignedTo:

Is anyone using an inline IDS like hogwash or snort-inline to drop packets in a system running shoreline? I _think_ I see how to configure it, but I''d be really interested in finding a howto or something... Thanks! Mike- -- Mornings: Evolution in action. Only the grumpy will survive. -- Please note - Due to the intense volume of spam, we have installed site-wide spam filters at

Hi all, I need to monitor all traffic and block bad requests on my guest machines and also on my xen host. To accomplish this I think to install snort on my dom0 host (rhel5). Somebody have tried this? What about performance on guests?? Many thanks ... -- CL Martinez carlopmart {at} gmail {d0t} com _______________________________________________ Xen-users mailing list

Hi. Does anyone know if it is possible to use ip_queue and IMQ at the same time - if I modprobe one then the other will fail to modprobe with init_module: Device or resource busy TIA Andy. _______________________________________________ LARTC mailing list / LARTC@mailman.ds9a.nl http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

hello list, i''ve set up shorewall and snort inline on a linux box. it works, but snort only sees traffic from new connections. and this is because shorewall automatically generates rules to accept established and related connections. how can i force shorewall to queue everything, so that snort can scan the hole traffic like in IDS mode. The setup i have now is really simple, just 2 zones

Hi Everyone, Can anyone confirm if a xen based domU can be used for snort setup? It is not for commercial use, rather just SOHO use. Regards, dot.yet _______________________________________________ Xen-users mailing list Xen-users@lists.xensource.com http://lists.xensource.com/xen-users

Hi Everyone, Can anyone confirm if a xen based domU can be used for snort setup? It is not for commercial use, rather just SOHO use. Regards, dot.yet _______________________________________________ Xen-users mailing list Xen-users@lists.xensource.com http://lists.xensource.com/xen-users

Dear Friends, I need to know, if RPM SNORT on repository DAG include option flexresp. Thanks Adriano

Plus I would like to let you know that it works like a charm. Snort can now see those packets. -----Original Message----- From: shorewall-users-bounces@lists.shorewall.net [mailto:shorewall-users-bounces@lists.shorewall.net] On Behalf Of Thibodeau, Jamie L. Sent: Wednesday, March 30, 2005 9:25 AM To: Mailing List for Shorewall Users Subject: RE: [Shorewall-users] Shorewall and an inline

You are awesome!!!! -----Original Message----- From: shorewall-users-bounces@lists.shorewall.net [mailto:shorewall-users-bounces@lists.shorewall.net] On Behalf Of Tom Eastep Sent: Wednesday, March 30, 2005 9:11 AM To: Mailing List for Shorewall Users Subject: Re: [Shorewall-users] Shorewall and an inline IDS (snort-inlineorhogwash) Tom Eastep wrote: > Thibodeau, Jamie L. wrote: >

Hi, I was wondering what people out there are doing to monitor puppetd in large environments. I''d love to hear what the best practices are around this. We have a few hundred hosts and are currently looking at the timestamps on the yaml files in /var/lib/puppet/yaml/facts/ on puppetmasters to make sure all clients are alive. Is it true that for a given client the fact file on the