|
|
|
IP Blacklisting for Snort 2.8.4.1 available |
Si vous voulez bloquer ce service sur vos fils RSS
Si vous voulez nous contacter ou nous proposer un fil RSS
Menu > Articles de la revue de presse : - l'ensemble [ tous | francophone] - par mots clé [ tous] - par site [ tous] - le tagwall [ voir] - Top bi-hebdo de la revue de presse [ Voir]
IP Blacklisting for Snort 2.8.4.1 available Par Security SauceLe [2009-05-14] à 00:32:49
Présentation : After a discussion on the Snort-users mailing list last week regarding using standard Snort rules to implement Reputation-based IP blocking in Snort (and how badly the performance sucked) I decided to write some code to do it the "right way". The result is the "iplist" preprocessor, a module that supports IP Blacklisting and whitelisting via user-provided lists of known hostile IP addresses. The internals of the system use the Patricia Trie code from the Snort 3.0 code tree to provide the primary address lookup mechanism. Currently I'm only supporting IPv4 addresses although the P-Trie code supports IPv6 addressing too. This patch has been applied against Snort 2.8.4.1 only. I've tested builds on OS X, Ubuntu and Fedora so far. It requires libdnet (or dumbnet-dev for those of you on Debian-based distros) to build properly. Check the README file that comes with it for instructions on patching it into your codebase. It supports inline blocking and alerting but not Flexresp-style TCP reset session shootdowns. Have a look and let me know what features you'd like or bugs you find. This code is purely EXPERIMENTAL, this is just me spending some of my spare time doing a fun coding project so if your machine sprouts legs and refuses to work until it receives part of the TARP bailout it's not my fault. Here's the link: http://www.snort.org/users/roesch/code/iplist.patch.tgz Technorati Tags: open source, sourcefire, tools, snort, cybersecurity []
Les mots clés de la revue de presse pour cet article : snort
Les videos sur SecuObs pour les mots clés : snort
Les mots clés pour les articles publiés sur SecuObs : snort
Les éléments de la revue Twitter pour les mots clés : snort
Les derniers articles du site "Security Sauce" :
- IP Blacklisting Version 2 for Snort 2.8.4.1 available
- IP Blacklisting for Snort 2.8.4.1 available
- RSA 2009
- Snort 3.0 Beta 3 Released
- Saving the data on an iPhone in Recovery Mode
- MacBook Pro and the slow-motion beachball of death crash
- So, here we are...
- Missing BlackHat
- CtrlAltItsNeat!
- Off to London
Menu > Articles de la revue de presse : - l'ensemble [ tous | francophone] - par mots clé [ tous] - par site [ tous] - le tagwall [ voir] - Top bi-hebdo de la revue de presse [ Voir]
Si vous voulez bloquer ce service sur vos fils RSS :
- avec iptables "iptables -A INPUT -s 88.191.75.173 --dport 80 -j DROP"
- avec ipfw et wipfw "ipfw add deny from 88.191.75.173 to any 80"
- Nous contacter par mail
| Mini-Tagwall des articles publiés sur SecuObs : | | | | sécurité, exploit, windows, attaque, outil, microsoft, réseau, audit, metasploit, vulnérabilité, système, virus, internet, usbsploit, données, source, linux, protocol, présentation, scanne, réseaux, scanner, bluetooth, conférence, reverse, shell, meterpreter, vista, rootkit, détection, mobile, security, malicieux, engineering, téléphone, paquet, trames, https, noyau, utilisant, intel, wishmaster, google, sysun, libre |
| Mini-Tagwall de l'annuaire video : | | | | curit, security, biomet, metasploit, biometric, cking, password, windows, botnet, defcon, tutorial, crypt, xploit, exploit, lockpicking, linux, attack, wireshark, vmware, rootkit, conference, network, shmoocon, backtrack, virus, conficker, elcom, etter, elcomsoft, server, meterpreter, openvpn, ettercap, openbs, iphone, shell, openbsd, iptables, securitytube, deepsec, source, office, systm, openssh, radio |
| Mini-Tagwall des articles de la revue de presse : | | | | security, microsoft, windows, hacker, attack, network, vulnerability, google, exploit, malware, internet, remote, iphone, server, inject, patch, apple, twitter, mobile, virus, ebook, facebook, vulnérabilité, crypt, source, linux, password, intel, research, virtual, phish, access, tutorial, trojan, social, privacy, firefox, adobe, overflow, office, cisco, conficker, botnet, pirate, sécurité |
| Mini-Tagwall des Tweets de la revue Twitter : | | | | security, linux, botnet, attack, metasploit, cisco, defcon, phish, exploit, google, inject, server, firewall, network, twitter, vmware, windows, microsoft, compliance, vulnerability, python, engineering, source, kernel, crypt, social, overflow, nessus, crack, hacker, virus, iphone, patch, virtual, javascript, malware, conficker, pentest, research, email, password, adobe, apache, proxy, backtrack |
|
|
|
|
|
