Home page logo
/

snort logo Snort mailing list archives

Re: IPS mode for snort
From: waldo kitty <wkitty42 () windstream net>
Date: Wed, 12 Jun 2013 12:29:09 -0400

On 6/12/2013 11:00, Mike Miller wrote:
4. If the Bad Guy think's you're actively blacklisting based on IP, they can
craft packets to make you go deaf. (Like making sure your Snort box is blocking
access to the outside DNS server...because it received a UDP packet that was
bad, that it thinks came from the DNS server.)

FWIW: this is where you would white list those external critical systems like 
trusted upstream DNS servers ;)

-- 
NOTE: No off-list assistance is given without prior approval.
       Please keep mailing list traffic on the list unless
       private contact is specifically requested and granted.

------------------------------------------------------------------------------
This SF.net email is sponsored by Windows:

Build for Windows Store.

http://p.sf.net/sfu/windows-dev2dev
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]