logo       

drop a packet from a preprocessor: msg#00026

security.ids.snort.devel

Subject: drop a packet from a preprocessor

As usual I posted this on the wrong list:

If I wanted to write a preprocessor to do nothing but drop a packet of type ICMP, is the following code correct?

if ( p->iph->ip_proto == 1 ) {
InlineDrop();
}

Is this correct? I'm running snort in Inline-mode, but this InlineDrop() command doesn't seem to kill the packet. Ideally I want to send a "reject" command back to iptables, but "drop" would also be sufficient.

Note, I have all the regular preprocessor boilerplate code, all I need to figure out is this one bit

Thanks,
--D


-------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642


<Prev in Thread] Current Thread [Next in Thread>
Google Custom Search

News | FAQ | advertise