Skip to main content
Snort_inline n00b

























Victor Julien
To: mnajem
Hi!

mnajem wrote:
> hi,
>
> i am relatively new to IDS and IPS stuffs.
> I am confused with
>
> snort rules, say here:
> http://www.bleedingthreats.net/bleeding-all.rules
>
> and snort_inline rules.
>
> do they have difference? i mean do snort_inline use snort's rules so
> that the iptables will drop messages got via libipq?

I think the difference is just that the snort_inline rules have the
action set to 'drop' already. The Snort rules are just using 'alert'.

> currently i'm trying to do research on improving speed of IDS/IPS
> whether on signature checking or if possible in layer 7 inspection/deep
> inspection.
>
> in addition, i also confused whether l7 netfilter do the same job of
> snort_inline on inspection packets.

The l7 matching in netfilter and also the string matching in netfilter
are very limited compared to Snort. This is because snort does many more
things with the packets before inspecting them, such as stream
reassembly, decoding, normalizing, etc. All these things are not
possible in netfilter. The advantage of the netfilter modules however,
is speed. The speed of a in-kernel matching mechanism is much higher.
The disadvantage is that it's trivial to evade detection by methods like
session splicing or tcp fragmentation and all kinds of encoding.

Hope this helps,
Victor

Comments

Popular posts from this blog

Danga Bay, Chevrolet Optra and bio...(eh?) I thought it was Debian(haha). My colleague point me to the AirAsia flight turbin and he told me, "Macam debian punya logo" I saw a spiral on top the turbin blades. Pretty much like Debian Logo That's spark me to shoot for a pix. And I was warned by the airport staff. Uh,uh. Flash lamp will spark burst,eh? I was presented my "mock" research proposal. Suggested "Profiling Bioinformatics Application Behavior on Distributed Computing Architecture". Eh, will this gonna be bioinformatics specific or hardware optimization specific.or? Flashback: I spent almost a week at the office. When it's Subh azan,went back to my house for bath and pray. Reading all the journals and papers was not funny,really. Tough eye balls. No world cup. Ewh. And have some VCD lure. Uh,uh. you gonna be kidding. Anyway, I learned a lot and UTM SLAB Research Course is no joke. Really. My proposal has been corrected with comments so I have
Gue dengan S2 gue. Sronok banget!