|
drop a packet from a preprocessor: msg#00026security.ids.snort.devel
As usual I posted this on the wrong list: If I wanted to write a preprocessor to do nothing but drop a packet of type ICMP, is the following code correct? if ( p->iph->ip_proto == 1 ) { InlineDrop(); } Is this correct? I'm running snort in Inline-mode, but this InlineDrop() command doesn't seem to kill the packet. Ideally I want to send a "reject" command back to iptables, but "drop" would also be sufficient. Note, I have all the regular preprocessor boilerplate code, all I need to figure out is this one bit Thanks, --D ------------------------------------------------------- Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642 |
|
| <Prev in Thread] | Current Thread | [Next in Thread> |
|---|---|---|
| Previous by Date: | Re: portrange: 00026, John Newman |
|---|---|
| Next by Date: | Re: drop a packet from a preprocessor: 00026, Will Metcalf |
| Previous by Thread: | portrangei: 00026, John Newman |
| Next by Thread: | Re: drop a packet from a preprocessor: 00026, Will Metcalf |
| Indexes: | [Date] [Thread] [Top] [All Lists] |
| News | FAQ | advertise |