[Snort-devel] snort inline mode in FreeBSD and IPFW
noname.esst at ...398...
Wed Jul 3 07:35:39 EDT 2013
I'm trying to run snort in inline mode in FreeBSD and IPFW as DAQ. But it does not drop packets. Here's my configurations:
Here is my custom snort.conf: (named snr.conf)
config daq: ipfw
config daq_mode: inline
config policy_mode: inline
output alert_full: stdout
Here is a simple rule file: (name snort.rule)
drop tcp any any -> any 23 (msg: "Drop telnet packets"; sid: 1000001)
pass ip any any -> any any
And here is what I do:
snort -c /root/snr.conf -Q --alert-before-pass
And I expect the ICMP packets to pass and telnet packets to drop. But both packet types pass! Am I missing something? Or snort is buggy in FreeBSD and inline mode?
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Snort-devel