Following your advice, I tried to change the cluster mode on the pfring
snort daq, but didn't get it to work as expected.
Firstly, I tried to use it by setting a parameter, like in suricata
(--pfring-cluster-type=cluster_flow_2_tuple), without success.
Then, I changed this line in daq_pfring.c (line 110 in current SVN version):
pfring_rc = pfring_set_cluster(ring_handle, context->clusterid,
cluster_per_flow);
to this one:
pfring_rc = pfring_set_cluster(ring_handle, context->clusterid,
cluster_per_flow_2_tuple);
Is this modification correct or do I have to change something else?
I'm testing it with a custom rule we have in Snort that alerts us of
LOIC-like requests, alerting if a single user makes >350 HTTP GET requests
in <10 seconds. In my old snort instance (2.8.6.1 and BPF filters to split
traffic) it fires, but in the new snorts (16 instances balanced with
pf_ring) i cannot get it to fire under the same exact conditions.
Thank you very much,
Jose Vila.
CSIRT-cv.
_______________________________________________
Ntop-misc mailing list
[email protected]
http://listgateway.unipi.it/mailman/listinfo/ntop-misc
