Hi, > Any recommendation about the optimal setup of snort and shorewall (or if > you suggest anything other than snort) would be appreciated.
Snort can be used as a packet filter and/or it can be used as a monitoring device. I didn't use its filtering abilities, I used it as a monitor. I couldn't find a way to get snort to monitor before iptables "does stuff." My last approach was to virtualise the firewall. On the host I installed openvswitch and made a switch with a monitoring port, connected to snort on yet another virtual machine. "Let those CPU cycles spin." I don't use it anymore. Maybe I should but I made it too complex for comfort. :) Mark ------------------------------------------------------------------------------ Learn the latest--Visual Studio 2012, SharePoint 2013, SQL 2012, more! Discover the easy way to master current and previous Microsoft technologies and advance your career. Get an incredible 1,500+ hours of step-by-step tutorial videos with LearnDevNow. Subscribe today and save! http://pubads.g.doubleclick.net/gampad/clk?id=58040911&iu=/4140/ostg.clktrk _______________________________________________ Shorewall-users mailing list Shorewall-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/shorewall-users
