SNORT_INLINE - The Easy Tutorial

Snort_Inline Introduction
Last Change : Jan 30 2008 english flag

Tool
Install
Ergonomy
Forum

Details What is Snort_Inline?
Screenshots
Prerequisites
Installation
Oinkmaster - Snort Rules
Oinkmaster - Bleeding Rules
Run Snort_Inline
BASE
Bridging

⚠️⚠️⚠️
Please check our website about
attractions in Western Switzerland !! (Please use english translation).

⚠️⚠️⚠️
Merci de consulter notre site sur les
activités à faire en Suisse romande !!

Snort_Inline
BASE
Oinkmaster
Bleeding rules

The Snort_inline IPS is a modified version of the famous Snort IDS.
It receives packets sent from the Netfilter firewall with the help of the lipipq library, compares them with Snort signature rules and tags them as drop if they match a rule, then finally sends them back to Netfilter where the Snort_Inline tagged packets are dropped.

Get more details about the packet processing through Snort_Inline.

An IDS (Intrusion Detection System) logs an alert when a packet matches a signature rule but does not discard or even modify it. This is different with an IPS (Intrusion Prevention System) where a packet matching a signature rule is blocked or modified.

You must be extremely careful with the "false positive" alarms (packets matching a signature rule but being in fact harmless) on an IPS because this can hurt the good behavior of the communications between your systems by blocking required links for the business.

For our test, we used Snort_Inline 2.4.5a and Ubuntu LTS 6.06. We noticed problems when using Ubuntu 6.10 or snort_inline-2.6.1.2-B1.
Give us your feedback if you tried our tutorial on a Debian Linux.