[Snort-users] Snort + IPF

Todd Ransom TRansom at ...197...
Mon Oct 9 09:36:15 EDT 2000


ipf should not affect snort at all.  I have snort on a box with this rule:

block in quick all

and I still see all the traffic with snort, tcpdump, etc.

maybe your problem lies elsewhere?

TR

-----Original Message-----
From: Avleen Vig [mailto:avleen at ...396...]
Sent: Monday, October 09, 2000 8:52 AM
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] Snort + IPF


Hello everyone :-)

I'm trying to run SNORT + IPF on a FreeBSD 4.1 release boxen.
I want SNORT to capture all access attempts (like it normally would),
but the problem is that IPF if blocking almost everything!

Does anyone know of a way I can have all incoming packets pass through
SNORT and then to IPF?

The box is not on a switch of anything so I can't do packet redirection
and things.


Thanks.
Singh
_______________________________________________
Snort-users mailing list
Snort-users at lists.sourceforge.net
http://lists.sourceforge.net/mailman/listinfo/snort-users



More information about the Snort-users mailing list