[Snort-users] Receive Only Cable...
FKnobbe at ...649...
Mon Jan 14 21:11:04 EST 2002
-----BEGIN PGP SIGNED MESSAGE-----
> -----Original Message-----
> From: Abe L. Getchell [mailto:abegetchell at ...530...]
> Sent: Monday, January 14, 2002 11:02 PM
> You wouldn't be able to launch a DoS against the system per
> say, but the
> application (in this case Snort) the system was running. Since the
> packets _are not_ being processed by the sensor's IP stack
> (it's running
> in stealth mode with IP disabled), the 'system' _would not_ 'see'
> or process the packets _at all_.
yeah, you're right. If you remove IP from that interface, a DoS would
not be possible. I was basing my response on the assumption that IP
is active and only the RO-cable is used. On well protected box, IP
should not be running, or at least with a different IP address.
Thanks for stressing that point.
-----BEGIN PGP SIGNATURE-----
Version: PGP Personal Privacy 6.5.8
Comment: PGP or S/MIME (X.509) encrypted email preferred.
-----END PGP SIGNATURE-----
More information about the Snort-users