Home page logo

snort logo Snort mailing list archives

AFPACKET Inline mode: dropping do not work
From: Oleg Gvozdev <jktu17 () gmail com>
Date: Tue, 21 May 2013 13:12:44 +0400

I have a problem with IPS mode.

I wonder how afpacket can drop/block traffic.

1.I saw daq-1.1.1/xxx/daq_afpacket.c : daq_acquire() use raw socket and
kernel rx_ring to receive ethernet data.
2. on each packet snort callback is called and if verdict after callback is
PASS, then daq use sento() to send packet on interface ; else: if verdict
is DROP - then nothing is sendig.
3.I comment sendto call in daq so any traffic will not be sent, but ICMP
pings for example go through snort as if snort was disabled.

So - I can not see how dropping can be done by daq: using only raw sockets
i think is not enough..?
Try New Relic Now & We'll Send You this Cool Shirt
New Relic is the only SaaS-based application performance monitoring service 
that delivers powerful full stack analytics. Optimize and monitor your
browser, app, & servers with just a few lines of code. Try New Relic
and get this awesome Nerd Life shirt! http://p.sf.net/sfu/newrelic_d2d_may
Snort-devel mailing list
Snort-devel () lists sourceforge net

Please visit http://blog.snort.org for the latest news about Snort!

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]