https://inliniac.net/blog/tag/ip6tunnel/ Recent content in Ip6tunnel on Inliniac Hugo en Fri, 11 Jan 2008 16:24:37 +0000 https://inliniac.net/blog/2008/01/11/tunnel-unwrapping-for-snort_inline-2801/ Fri, 11 Jan 2008 16:24:37 +0000 https://inliniac.net/blog/2008/01/11/tunnel-unwrapping-for-snort_inline-2801/ <p>Not many people have native IPv6 connectivity and use some form of tunneling. For this reason Nitro Security asked me to develop a Snort preprocessor to unwrap various tunnels. This resulted in the preprocessor &lsquo;ip6tunnel&rsquo;, which I uploaded to Snort_inline&rsquo;s SVN yesterday. The preprocessor is capable of unwrapping IPv6-in-IPv4, IPv6-in-IPv6, IPv4-in-IPv6, IPv4-in-IPv4 and finally IPv6-over-UDP. The latter is used by Freenet6.</p> <p>I chose to develop it as a preprocessor because this allows Snort to inspect both the original packet and the tunnel packet(s). The preprocessor supports recursive unwrapping. The recursion depth is limited to 3 by default, but can be configured differently. Get the preprocessor from Snort_inline&rsquo;s SVN by checking out the latest trunk:</p>