[Snort-users] Questions with this Snort IPS setup

waldo kitty wkitty42 at ...14940...
Tue Mar 12 11:36:43 EDT 2013


On 3/11/2013 18:21, Ricky Huang wrote:
> I have questions on a couple of things:
> 1) With ipfw divert all traffic through Snort, if Snort dies for any reason, I
> will be effectively locked out. What's the standard practice to leave one with a
> backdoor to get back to the remote server?

third NIC for administration?

> 2) A quick search through pulledpork-updated snort.rules shows that there aren't
> any drop rules; they're all alerts. Is there a standard set of drop rules for an
> IPS?

the list just went thru this a little while back... all distributed rules are 
alerts... if you need them as drops, then you need to tell your rules management 
software which ones to change to drop so it will do it each time it updates the 
rules... oinkmaster uses modifysid options in a config file... pulledpork has a 
similar functionality but i think you list the sid of the rule in a specific 
file to get the edit... not sure as i don't use pulledpork (yet??)

> 3) Are there ways of creating email alerts such that the admin staff receives
> alert emails on certain events?

this would be something that your reporting tools would handle...




More information about the Snort-users mailing list