[Snort-users] how to block an attacker.

Martijn Heemels martijn at ...1736...
Tue Apr 3 20:39:10 EDT 2001


 
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi Samuel,

> I am using Snort 1.7 on RH7 and would like to know of any 
> products that are
> used to block the IP address of the detected attacker.
> 
> The way I would like it to work is that Snort detects an attack, 
> records the
> IP and then block that IP for accessing that service/s.

I noticed something called Guardian on the snort.org website in the
contributions section on the download page. It uses ipchains to block
any further packets.
I haven't tried it though...

Hope this helps,
Martijn

- -- 
M. Heemels          | Yoda of Borg are we.
Eindhoven, NL       | Futile is resistance.
martijn at ...1736... | Assimilate you, we will.
   *** encrypt for secure email ***
 

-----BEGIN PGP SIGNATURE-----
Version: PGPfreeware 7.0.3 for non-commercial use <http://www.pgp.com>

iQA/AwUBOsptLhLMC0rbivl4EQJtnwCg/X4XE8s/uVGWDRQTwmgfKXY/qdcAnAyf
lzDWh4oHkjCY+gfNn17QwlzY
=s487
-----END PGP SIGNATURE-----





More information about the Snort-users mailing list