Re: Fwd: snort with nfququ

["Chinmay Mahata" <chinmay_mahata () rediffmail com>]

Hi,
    For using NFQ in snort you need to use following arguments to run snort:
-Q -c ${CONF} --daq nfq --daq-var queue=${NFQ_NUM} --daq-var queue_len=${NFQ_LEN} --daq-var device=${NFQ_DEV}


And then put iptables rules in your INPUT, OUTPUT and FORWARD chains of filter table, like -

iptables -t filter -A ${CHAIN_NAME} -j NFQUEUE --queue-num ${NFQ_NUM}

Hope you got it.

Cheers,
--Chinmay




From: Meysam Farazmand <farazmand.meisam () gmail com>
Sent: Thu, 09 May 2013 21:54:44 
To: snort-users () lists sourceforge net
Subject: [Snort-users] Fwd: snort with nfququ

Hello,

i want to run Snort as IPS with NFQUEUE. i have installed libnetfilter_queue and loaded it in snort.
Now i wanted to know which iptables command do i have to issue to give traffic from kernel to Snort?



Regards



------------------------------------------------------------------------------

Learn Graph Databases - Download FREE O'Reilly Book

"Graph Databases" is the definitive new guide to graph databases and 

their applications. This 200-page book is written by three acclaimed 

leaders in the field. The early access version is available now. 

Download your free book today! http://p.sf.net/sfu/neotech_d2d_may
_______________________________________________

Snort-users mailing list

Snort-users () lists sourceforge net

Go to this URL to change user options or unsubscribe:

https://lists.sourceforge.net/lists/listinfo/snort-users

Snort-users list archive:

http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users



Please visit http://blog.snort.org to stay current on all the latest Snort news!

------------------------------------------------------------------------------
AlienVault Unified Security Management (USM) platform delivers complete
security visibility with the essential security capabilities. Easily and
efficiently configure, manage, and operate all of your security controls
from a single console and one unified framework. Download a free trial.
http://p.sf.net/sfu/alienvault_d2d

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!