Inliniac » libdnet http://www.inliniac.net/blog Everything inline. Thu, 29 Jul 2010 19:38:06 +0000 en hourly 1 http://wordpress.org/?v=3.0.1 Snort_inline updated to 2.8.0.1 in SVN http://www.inliniac.net/blog/2008/01/09/snort_inline-updated-to-2801-in-svn.html http://www.inliniac.net/blog/2008/01/09/snort_inline-updated-to-2801-in-svn.html#comments Wed, 09 Jan 2008 15:41:19 +0000 Victor Julien http://www.inliniac.net/blog/2008/01/09/snort_inline-updated-to-2801-in-svn.html I’ve just committed an update to Snort_inline’s SVN. It brings it to the Snort 2.8.0.1 level. It supports both IPv4 and IPv6 on IPQ and NFQ. I have not been able to test IPFW on IPv6, so I don’t think that will work currently.

This update removes the libdnet dependency and replaces it with libnet 1.1. To be able to send ICMPv6 unreachable packets you will need the libnet 1.1 patch I wrote a while ago. You can find that here. Get the latest Snort_inline by checking out SVN:

svn co https://snort-inline.svn.sourceforge.net/svnroot/snort-inline/trunk

Consider the code to be of beta quality for now, so be careful with it. Please report any problems with it!

Again, a big thank you to NitroSecurity for funding this work!

]]> http://www.inliniac.net/blog/2008/01/09/snort_inline-updated-to-2801-in-svn.html/feed 0 Working on Snort_inline 2.8.0.1 http://www.inliniac.net/blog/2007/12/22/working-on-snort_inline-2801.html http://www.inliniac.net/blog/2007/12/22/working-on-snort_inline-2801.html#comments Sat, 22 Dec 2007 12:49:20 +0000 Victor Julien http://www.inliniac.net/blog/2007/12/22/working-on-snort_inline-2801.html The last week I’ve been working on bringing Snort_inline to the Snort 2.8.0.1 level, including it’s IPv6 support. I’m almost ready to commit it to SVN, there are just some issues I need to fix in the inline specific code. The code will get rid of libdnet and use libnet 1.1 for sending reset/reject packets for both IPv4 and IPv6. After committing I will start working on getting the IPv6 features I wrote for NitroSecurity into this tree. This includes more matches, tunnel decoding (including for example the freenet6 tunnel, etc). So stay tuned!

]]> http://www.inliniac.net/blog/2007/12/22/working-on-snort_inline-2801.html/feed 2 Differences between Snort and Snort_inline http://www.inliniac.net/blog/2007/05/14/differences-between-snort-and-snort_inline.html http://www.inliniac.net/blog/2007/05/14/differences-between-snort-and-snort_inline.html#comments Mon, 14 May 2007 17:05:41 +0000 Victor Julien http://www.inliniac.net/blog/?p=74 Every few weeks the same question comes up: what is the difference between Snort in inline mode and Snort_inline. This makes sense, because the Snort_inline documentation and website fail to explain it. In this post I will try to highlight the main differences. In general I can say that we try to develop Snort_inline as a patchset on top of Snort. Snort_inline is focused at improving the inline part of Snort. Originally of course, Snort’s inline capabilities were developed in the Snort_inline project. With Snort 2.3.0RC1 they were merged into mainline Snort.

Convenience

We did a number of things to make Snort_inline a little more convenient for inline users.

  • inline is enabled by default in ./configure
  • we got rid of libnet 1.0.2a, switched to libdnet 1.1 instead
  • a snort_inline specific manual page was added, as well as some extra docs
  • a example configuration file for inline use is supplied

Added functionality

  • we support Linux’ new queue’ing mechanism called nfqueue. This was contributed by Nitro Security. Nfqueue supports running multiple copies of Snort_inline to take advantage of SMP and reduce risk of denial of service when Snort_inline should crash.
  • stickydrop preprocessor enables you to add options to the rules to block an ipaddress for a configurable amount of time
  • bait-and-switch preprocessor (Linux only) allows you to redirect traffic from a host to a honeypot based on the rules
  • clamav preprocessor is included (you still need to pass –enable-clamav to ./configure)
  • reinject action for FreeBSD: reinjects an accepted packet into the ipfw list at a specific rule number

Improved for inline use

  • reject action can send RST packets to both source and destination
  • stream4 can drop attacks detected in the reassembled stream. It also enforces the TCP window. It implements a number of ideas from Vern Paxson on TCP reassembly, such as a limit on the number of out of order packets and bytes that are accepted in a stream.
  • some fixes for FreeBSD

As the list shows, if you are interested in Snort running inline, using Snort_inline might be a better choice for you!

]]> http://www.inliniac.net/blog/2007/05/14/differences-between-snort-and-snort_inline.html/feed 4