[Snort-users] snort inline behavior

/dev/null dev.null at ...9081...
Tue Nov 25 22:40:07 EST 2003

First, thanks to all for the help on getting the right inline version

I went through my firewall script and every '-j ACCEPT' I had, I changed to
'-j QUEUE' and re-built my iptable chains.  Did `insmod ip_queue`, loaded
fine.  Started up snort_inline with '-DQ -l ... -c ...'.  Everything looked
fine.  After a couple of minutes I decided instead of -D (daemon) I'd rather
see a little output to make sure it was seeing packets as expected.  I was
ssh'ed into the box so I figured my iptables "ESTABLISHED,RELATED -j QUEUE"
entry should show a lot of ssh packets.  I do a `kill` on the snort_inline
pid and suddenly my ssh connection goes dead - I'm waiting for it to timeout
now.  In the mean time I've tried to re-ssh back into the box, but they just
time out.

I'm wondering if this is some weird deal that if you don't have someone
running on QUEUE that the packets never get ACCEPTed and by shutting snort
down I just shot myself in the foot.

I'm going to go ahead and set up another box (that one is 1hr away, and the
tech guy will arive in the morning and I'll walk him through changing QUEUE
back to ACCEPT and restart the firewall...) and getting it tested locally
where if it breaks I can fix it easily.

In the mean time I was wondering if you guys could lend your experience
here.  Does killing snort_inline while it's watching the QUEUE break any
connections that are getting -j QUEUEed?  What happened here?


More information about the Snort-users mailing list