Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email firstname.lastname@example.org
Re: [Snort-users] Sticky-drop
From: Patrick Walsh (pwalshesoft.com)
Date: Wed Dec 07 2005 - 17:32:02 CST
> > Any thoughts on how I can get my hands on or learn more about
> > sticky-drop?
> I think you are talking about sdrop?
I'm familiar with sdrop. My question is in response to this post from
Will earlier today:
> sticky-drop in snort-inline can do this. You could probably
> accomplish the same thing with Snortsam In InlineMode(); but I haven't
> tried it.
By which I assume that sticky-drop drops the connection and also drops
future connections from the target IP.
And then there's this posting by Will from 3/30/05:
> The IPS functionality drops or rejects induvidual packets, unless you
> are using the sticky-drop preprocessor from snort_inline-2.3.0-RC1 and
> tell it otherwise.
I did find some related preprocessor files in the
snort_inline-2.3.0-RC1 tree, but those files don't exist in the 2.4.3
tree, nor can I find any documentation on exactly what they do or how to
make use of them...
Anyone know what this is about or if it works or is supported
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)
-----END PGP SIGNATURE-----
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems? Stop! Download the new AJAX search engine that makes
searching your log files as easy as surfing the web. DOWNLOAD SPLUNK!
Snort-users mailing list
Go to this URL to change user options or unsubscribe:
Snort-users list archive: