[Snort-users] How does Snort protect itself ?

Vinay A. Mahadik VAMahadik at ...6245...
Sun Sep 8 14:30:03 EDT 2002

KD Rajkumar wrote:

> Hi,
> How does Snort protect itself against attacks. If an attacker is trying 
> to take down the IDS itself, is Snort capable of detecting and thwarting 
> it ?

Briefly.. although perhaps not optimized for self-defense, there are 
mechanisms like 'memcap' (and consequent aggressive pruning, and random 
nuking of states), and 'timeout' for preprocessors like frag2, stream4. 
There's '-z est' defense against stick/snot attacks. For evasion 
attacks, there are dedicated preprocessors and preprocessor options, and 
some internal source code tweaks like the 1.9.x's pseudo-random 
FLUSH_POINTs in stream4. These are just pointers and not a complete 
list.. It would be good to have a separate discussion in the manual 
about these..

Vinay A. Mahadik
Summer Intern
System & Network Security Group
Lawrence Berkeley National Lab
(510) 495 2618

More information about the Snort-users mailing list