Re: drop a packet from a preprocessor

you should be able to call InlineDrop(); or InlineReject(); from anywhere.....

Regards,

Will

On 4/29/06, David Cann <dlcann@xxxxxxxxxxxxxxxxxxxx> wrote:
> As usual I posted this on the wrong list:
>
> If I wanted to write a preprocessor to do nothing but drop a packet of
> type ICMP, is the following code correct?
>
> if ( p->iph->ip_proto == 1 ) {
>    InlineDrop();
> }
>
> Is this correct? I'm running snort in Inline-mode, but this InlineDrop()
> command doesn't seem to kill the packet. Ideally I want to send a
> "reject" command back to iptables, but "drop" would also be sufficient.
>
> Note, I have all the regular preprocessor boilerplate code, all I need
> to figure out is this one bit
>
> Thanks,
> --D
>
>
> -------------------------------------------------------
> Using Tomcat but need to do more? Need to support web services, security?
> Get stuff done quickly with pre-integrated technology to make your job easier
> Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
> http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
> _______________________________________________
> Snort-devel mailing list
> Snort-devel@xxxxxxxxxxxxxxxxxxxxx
> https://lists.sourceforge.net/lists/listinfo/snort-devel


-------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid0709&bid&3057&dat1642