Inliniac » clamav http://www.inliniac.net/blog Everything inline. Wed, 11 Jan 2012 19:09:17 +0000 en hourly 1 http://wordpress.org/?v=3.3.1 Differences between Snort and Snort_inline http://www.inliniac.net/blog/2007/05/14/differences-between-snort-and-snort_inline.html http://www.inliniac.net/blog/2007/05/14/differences-between-snort-and-snort_inline.html#comments Mon, 14 May 2007 17:05:41 +0000 Victor Julien http://www.inliniac.net/blog/?p=74 Every few weeks the same question comes up: what is the difference between Snort in inline mode and Snort_inline. This makes sense, because the Snort_inline documentation and website fail to explain it. In this post I will try to highlight the main differences. In general I can say that we try to develop Snort_inline as a patchset on top of Snort. Snort_inline is focused at improving the inline part of Snort. Originally of course, Snort’s inline capabilities were developed in the Snort_inline project. With Snort 2.3.0RC1 they were merged into mainline Snort.

Convenience

We did a number of things to make Snort_inline a little more convenient for inline users.

  • inline is enabled by default in ./configure
  • we got rid of libnet 1.0.2a, switched to libdnet 1.1 instead
  • a snort_inline specific manual page was added, as well as some extra docs
  • a example configuration file for inline use is supplied

Added functionality

  • we support Linux’ new queue’ing mechanism called nfqueue. This was contributed by Nitro Security. Nfqueue supports running multiple copies of Snort_inline to take advantage of SMP and reduce risk of denial of service when Snort_inline should crash.
  • stickydrop preprocessor enables you to add options to the rules to block an ipaddress for a configurable amount of time
  • bait-and-switch preprocessor (Linux only) allows you to redirect traffic from a host to a honeypot based on the rules
  • clamav preprocessor is included (you still need to pass –enable-clamav to ./configure)
  • reinject action for FreeBSD: reinjects an accepted packet into the ipfw list at a specific rule number

Improved for inline use

  • reject action can send RST packets to both source and destination
  • stream4 can drop attacks detected in the reassembled stream. It also enforces the TCP window. It implements a number of ideas from Vern Paxson on TCP reassembly, such as a limit on the number of out of order packets and bytes that are accepted in a stream.
  • some fixes for FreeBSD

As the list shows, if you are interested in Snort running inline, using Snort_inline might be a better choice for you!

]]> http://www.inliniac.net/blog/2007/05/14/differences-between-snort-and-snort_inline.html/feed 8 Snort_inline in svn updated to 2.6.1.3 http://www.inliniac.net/blog/2007/02/22/snort_inline-in-svn-updated-to-2613.html http://www.inliniac.net/blog/2007/02/22/snort_inline-in-svn-updated-to-2613.html#comments Thu, 22 Feb 2007 07:59:05 +0000 Victor Julien http://www.inliniac.net/blog/?p=65 This week SourceFire published a security advisory for (among others) Snort version 2.6.1.2, on which Snort_inline is based. So I took some time to update Snort_inline. Normally this would have taken Will and me quite some time, but since we switched to using svn those days are gone. I was able to update it in under a hour. I was very happy I blogged about the procedure to follow, since I had already forgotten about it ;-)

Will is preparing a release based on this, which should also build with ClamAV 0.90.

Anyway, svn is up to date, so if you are using Snort_inline and rely on the DCE/RPC preprocessor, please pull the code from svn.

Check it out! :-)

]]> http://www.inliniac.net/blog/2007/02/22/snort_inline-in-svn-updated-to-2613.html/feed 0