Re: Snort inline problem

[James Lay <jlay () slave-tothe-box net>]

On 2016-10-19 11:26, mostafa ammar wrote:
> Dear all,
>
> i installed snort inline on ubuntu vm.
> i configured /etc/network/interfaces with the following configuration
>
> auto eth2
> iface eth2 inet manual
>     up ifconfig eth2 0.0.0.0 up
>     up ip link set eth2 promisc on
>     post-up ethtool -K eth2 gro off
>     post-up ethtool -K eth2 lro off
>     down ip link set eth2 promisc off
>     down ifconfig eth2 down
>
> # Second Bridged Interface
> auto eth3
> iface eth3 inet manual
>     up ifconfig eth3 0.0.0.0 up
>     up ip link set eth3 promisc on
>     post-up ethtool -K eth3 gro off
>     post-up ethtool -K eth3 lro off
>     down ip link set eth3 promisc off
>     down ifconfig eth3 down
>
> currently ping is passing successfully between 2 interfaces but any
> other protocol is not passing i tried ssh,rdp,http
> the session is reset
> any suggestion how to solve this problem?



You'll want to rethink how you do it...snort creates it's own bridge 
with, for example, afpacket:

"If you want to run afpacket in inline mode, you must set device to one 
or more interface pairs, where each member of a pair is separated by a 
single colon and each pair is separated by a double colon like this:

     eth0:eth1
or this:

     eth0:eth1::eth2:eth3"

http://manual-snort-org.s3-website-us-east-1.amazonaws.com/node7.html

I did the same thing you did when I started out.

James

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most 
engaging tech sites, SlashDot.org! http://sdm.link/slashdot
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!