snort inline Test

[Zeinab Zali <zeinabzali () gmail com>]

Hi,
I have compiled snort with --enable-inline mode successfully. I configure
iptables with below commands:
"
modprobe ip_queue
export QUEUE="yes"
iptables -F FORWARD
iptables -F INPUT
iptables -F OUTPUT
iptables -A OUTPUT -j QUEUE
iptables -A INPUT -j QUEUE
iptables -A FORWARD -j QUEUE
"
Then I changed all the snort alert rules to drop rules.
for testing I run snort with below command:
"snort -c ./etc/snort_inline.conf  -Q  -l /var/log/snort_inline/ -v"
then I try to portscan my computer from another computer with nmap. Snort
generated portscan alert, but I the portscanning procedure with nmap was
done successfully too. I expect snort inline not to allow nmap portscan.
What is the problem?
Thanks in advance,

-- 
Zeynab Zali

------------------------------------------------------------------------------

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users