memory of nobody

Snort_inline n00b Victor Julien To: mnajem Hi! mnajem wrote: > hi, > > i am relatively new to IDS and IPS stuffs. > I am confused with > > snort rules, say here: > http://www.bleedingthreats.net /bleeding-all.rules > > and snort_inline rules. > > do they have difference? i mean do snort_inline use snort's rules so > that the iptables will drop messages got via libipq? I think the difference is just that the snort_inline rules have the action set to 'drop' already. The Snort rules are just using 'alert'. > currently i'm trying to do research on improving speed of IDS/IPS > whether on signature checking or if possible in layer 7 inspection/deep > inspection. > > in addition, i also confused whether l7 netfilter do the same job of > snort_inline on inspection packets. The l7 matching in netfilter and also the string matching in netfilter are very limited compared to Snort. This is because snort ...

Snort_inline: Compilation Issues After gave up with Debian since I can't resolve libdnet problem on Debian, I opt to take Fedora Core 6 with reasons: 1-Community driven 2-Less compilation (machine is Pentium 3. I just add up my own 128 SDRAM ) 3-Package management However, I regret that yum slowness which drive me upset. Everything else fine. Funny stuff: I use Ubuntu on my laptop and when I want to use yum search facility, it leads to #yum cache search ROTFL (apt-cache is for Debian variant which works almost the same with yum search. The command given above mixed) I saw victor posted something on his blog regarding snort_inline dropped libipq dependecies horror as posted here I checkout'ed the SVN version, compile it and and succeeded.