[Snort-users] Snort UDP traffic in loopback interface

Максим Завилов zavilov_max at ...1975...
Fri Dec 13 10:41:48 EST 2013


Hi  all!!!

Please tell me why snort  displays  "Snort Alert"
 instead msg : "DOS attack" for example  (as specified in Rule)
For example:
12/12-14: 10:31.185469 [**] [1:100000160:2]  Snort Alert [1:100000160:0] [**] [Classification: Attempted Denial of Service] [Priority: 2] {TCP} 213.180 .204.183:80 -> 192.168.1.160:43608

and one more question:  
I run snort in inline mode with the following parameters { /snort –Q --daq nfq –daq-var queue=1 -l /var/log/snort –c /etc/snort/snort.conf –v }
rule for iptables the following: iptables -A PREROUTING -t mangle -i eth0 -j NFQUEUE --queue-num 1
how to do so to Snort droped packets? replacement  alert -> drop in rules did not help me ....what am I doing wrong? 
Any can help me? I will be very grateful to you.

________


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20131213/eacc42b7/attachment.html>


More information about the Snort-users mailing list