Snort Forums Archive

Archive Home » General Security Discussion » Snort Capabilities? Can we protect proactively ?

Please note that the categories listed below represent an archived version of our forums pages. To view the current version and be able to post and reply to threads, please register and login here to go to the full forums pages.

[ Notice: Full Version of This Topic ]

Snort Capabilities? Can we protect proactively ?

Posted by anantm on October 28, 2006 22:57:53

Most of the documents talk about complete blockage of sites on detection of an attack pattern, while a default snort would just listen and report issues. Can it protect on the fly with other methods -

a) terminating just the session/ connection that is exploting a vulnerability - instead of adding a firewall rule to block the IP completely?
b) modify/ correct the traffic on-the-fly before it reaches a vulnerable server?

regards

Posted by duh on October 30, 2006 05:43:39

It can do type A), that is what snort-inline is for.
I dont think anyone has written away to do b). Yet.

I had someone pitch a device that did b) to me once, wasnt too impressed, bluelane i think it was called?

Posted by anantm on October 30, 2006 07:20:43

Thanks Duh! What I read in the posts was inserting a firewall rule to block the IP for some time - and nothing to terminate just the connection. I think I would need to write some script just to terminate a connection -I think that's something I would put even if the IP is in whitelist. If this offence is repeated often - stricter actions can be taken.

I heard that device is pretty good. Didn't get an opportunity to try and test. I heard they are doing a lot of QA and a promise to release withiin 24 hours of releases from microsoft and oracle. What were the problems you faced?

Posted by duh on November 01, 2006 12:13:34

Actually snort-inline should be able to reset an active conection.
I personally use plain snort, and 'shun' addresses on the firewall if they have 10 priortity 1 hits in an hour. An app I wrote that checks against a mysql db.