[Snort-users] IPS snort generating (DUP) packets

mehdi chourib c_didoux at ...1855...
Tue Dec 13 07:53:36 EST 2016


Dear all, 

My current set up is the following: 

[machine 1] <=> [snort IPS] <=> [machine 2] 

When I activated IPS and pinged [machine 2] from [machine 1], I got (DUP)! packet (duplicated) although all packets reach sent from [machine1] have reached [machine2]. 

When snort IPS was disabled, no problem on pings at all. I assume that most probably my setup of snort is not optimal for IPS inline.

Can you please give me some advises? What are the requirements towards NIC for snort IPS inline mode.? 

Thank you very much.

Best Regards.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20161213/7e375df8/attachment.html>


More information about the Snort-users mailing list