[Snort-users] why old libnet?

Matt Kettler mkettler at ...4108...
Mon Mar 28 09:17:07 EST 2005


Florin Andrei wrote:

>What is the reason why Snort can only use the old, deprecated,
>libnet-1.0.x?
>Since other apps are likely to use already the newer, supported,
>libnet-1.1, there might be conflicts on systems using both types of
>apps.
>

Really, the only part of snort that uses libnet is flexresp. If you're
not using flexresp, snort shouldn't be looking for libnet.

As for flexresp itself, it's getting to be a bit on the "aged" side. I
know one of the SF guys (Chris? Jeff?) was working on a "flexresp2", but
it looks like 2.3.2 still only includes the old version.

I also think that while Flexresp is useful, people believe it to be more
useful than it is. Flexresp is really pretty limited. It's useful
against automated probes, but really only acts as a hurdle to jump over
for a skilled manual attack. Even against automated probes, flexresp
isn't 100% effective, since it relies on being able to advance the TCP
sequence number first. Flexresp uses some tricks to give it a major
advantage, but it still boils down to being a race condition.

Now that snort has an official inline module, you really should consider
using it instead of flexresp if inline is feasible in your network and
on your platform.




More information about the Snort-users mailing list