[Snort-users] Does Snort support country blocking

JJC cummingsj at ...11827...
Wed Mar 6 12:22:45 EST 2013


You can add entire CIDR blocks of the offending countries to your IP
Rep preprocessor (or add them to your firewall before it gets to your
IPS also) kind of thing... It's not uncommon for US only based
companies to block all of APNIC for example...

JJC

On Wed, Mar 6, 2013 at 10:15 AM, Ricky Huang <rhuang.work at ...11827...> wrote:
> Hello,
>
> I would like to know if Snort supports blocking by geographic location?
> Using something like integration with GeoIP.  This is for the case where our
> servers are known to receive frequent attacks from a certain country and
> would like to block it.
>
>
> Thanks!
>
> ------------------------------------------------------------------------------
> Symantec Endpoint Protection 12 positioned as A LEADER in The Forrester
> Wave(TM): Endpoint Security, Q1 2013 and "remains a good choice" in the
> endpoint security space. For insight on selecting the right partner to
> tackle endpoint security challenges, access the full report.
> http://p.sf.net/sfu/symantec-dev2dev
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
>
> Please visit http://blog.snort.org to stay current on all the latest Snort
> news!




More information about the Snort-users mailing list