[Snort-users] inline mode works(seems) without compiling with --enable-inline option

Russ Combs rcombs at ...1935...
Wed Aug 5 11:48:16 EDT 2009


Hey Justin,

Thanks for the patch.  The -Q option, and the inline implementation in
general, is a little confusing.  However, there is no warning without
--enable-inline because it allows Snort to be deployed inline using 3rd
party pcap implementations that don't require ipq or ipfw.

Compounding that, the help for -Q is only output for ipq builds.  The help
will be addressed in an upcoming release.

Russ

On Wed, Aug 5, 2009 at 8:11 AM, justin joseph <justinjoseph007 at ...11827...>wrote:

> Hi
>
> Were trying to configure snort-inline on Ubuntu hardy (snort version
> 2.7.0) for some days.
> Today figured out by looking at the code that even if snort was not
> compiled with --enable-inline
> option, it was seemingly running with the -Q option(drop, sdrop,
> reject won't work off course)
>
> IMHO this confuses a newbie user like me because if snort was not
> compiled enabling
> inline mode then it is supposed to print error and abort if user tries
> to run with the -Q option.
>
> Attached patch against 2.8.4(changes in snort.c) or something like
> that would be nice IMHO.
>
> thank you
> Justin
>
>
> ------------------------------------------------------------------------------
> Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
> trial. Simplify your report design, integration and deployment - and focus
> on
> what you do best, core application coding. Discover what's new with
> Crystal Reports now.  http://p.sf.net/sfu/bobj-july
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users<https://lists.sourceforge.net/lists/listinfo/snort-users%0ASnort-users>list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20090805/151cdbec/attachment.html>


More information about the Snort-users mailing list