Hi Justin, I agree with you this should be configurable but is still valid in IDS mode
Your problem is not the fact you are running as IDS but that other apps require to see that traffic Enviado desde mi iPhone El 03/03/2012, a las 22:17, Justin Azoff <[email protected]> escribió: > On Sat, Mar 03, 2012 at 09:14:51PM +0100, Jaime Nebrera wrote: >> Hi Justin, >> >> I believe the idea is to reduce the load on snort when you know it going to >> drop a packet >> That is, snort receives a stream until decides it's a drop. Further packets >> in that flow will be dropped directly at pfring layer (or even at hardware >> layer if you are lucky and own a card that supports hardware filters) >> >> This of course makes snort see less packets, and thus allows snort more >> room for extra traffic > > The problems being that > > * Snort is not running inline so it isn't actually dropping packets > * Other things are running on the box that need to see all the packets > * The feature does not appear to even work anyway, over time the > majority of the traffic ends up being dropped. > > 4/5ths of our traffic is definitely not alert traffic, so I'm not really > sure what was being dropped. Is there a way to print out the current > pf_ring filter? > > so.. bug of feature, I think this needs to be an option that you can > turn off. Even if it worked 100% correctly, it would still break the > other apps running on the box. > > -- > -- Justin Azoff > -- Network Security & Performance Analyst > _______________________________________________ > Ntop-misc mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop-misc _______________________________________________ Ntop-misc mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-misc
