RE: [Snort-users] RE: Attack on snort running in Public Zone

permalink · #1 (**permalink**) 11-15-2003

This is a multi-part message in MIME format.

------=_NextPart_000_0060_01C3AB5D.D61DA0C0
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 7bit

Michael,

I guess your question is for James ?

Regards
KS

-----Original Message-----
From: snort-users-admin@lists.sourceforge.net
[mailto:snort-users-admin@lists.sourceforge.net]On Behalf Of Michael
Steele
Sent: Saturday, November 15, 2003 8:46 AM
To: snort-users@lists.sourceforge.net
Subject: RE: [Snort-users] RE: Attack on snort running in Public Zone

KS,

Is this is a real solution or just a waste of bandwidth?

Maybe there was a point here I didn't get?

Cheers...

-Michael Steele
--
System Engineer / Security Support Technician
mailto:michaels@winsnort.com
Website: http://www.winsnort.com
Snort: Open Source Network IDS - http://www.snort.org

> -----Original Message-----
> From: snort-users-admin@lists.sourceforge.net [mailto:snort-users-
> admin@lists.sourceforge.net] On Behalf Of james
> Sent: Friday, November 14, 2003 4:54 PM
> To: snort-users@lists.sourceforge.net
> Subject: Re: [Snort-users] RE: Attack on snort running in Public Zone
>
> Well, don't run in on a OS that can be DoS'ed.
>
>
> ----- Original Message -----
> From: "KS" <kanwaljeet@emind.com>
> To: <snort-users@lists.sourceforge.net>
> Sent: Tuesday, November 11, 2003 8:15 AM
> Subject: [Snort-users] RE: Attack on snort running in Public Zone
>
>
> : Is anyone out there who can help ????????
> :
> :
> : -----Original Message-----
> : From: KS [mailto:kanwaljeet@emind.com]
> : Sent: Monday, November 10, 2003 8:48 PM
> : To: snort-users@lists.sourceforge.net
> : Subject: Attack on snort running in Public Zone
> :
> :
> : Helllo Everybody.
> :
> : I have snort running on win2k and it is working fine so far.I had
> placed
> : it in DMZ to monitor the malicious traffic passing through firewall and
> Now
> : i want to put another snort win2k system in Public zone i.e in between
> my
> : router and firewall so i can know which traffic is actually hitting the
> : outside interface of my firewall.
> : My concern is : Since my snort system ( win2k ) is gonna be on public
> IP
> : address , what will happen if somebody runs a Denial of service attack
> on my
> : snort system itself.
> : How can i be sure that my snort system running on win2k is safe from
> DOS
> : attack ?
> :
> : Thanks
> : KS
> :
>
>
> -------------------------------------------------------
> This SF. Net email is sponsored by: GoToMyPC
> GoToMyPC is the fast, easy and secure way to access your computer from
> any Web browser or wireless device. Click here to Try it Free!
> https://www.gotomypc.com/tr/OSDN/AW/...=mm/g22lp.tmpl
> _______________________________________________
> Snort-users mailing list
> Snort-users@lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/...fo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.p...st=snort-users

-------------------------------------------------------
This SF. Net email is sponsored by: GoToMyPC
GoToMyPC is the fast, easy and secure way to access your computer from
any Web browser or wireless device. Click here to Try it Free!
https://www.gotomypc.com/tr/OSDN/AW/...=mm/g22lp.tmpl
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users

------=_NextPart_000_0060_01C3AB5D.D61DA0C0
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD><TITLE></TITLE>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Dus-ascii">
<META content=3D"MSHTML 6.00.2600.0" name=3DGENERATOR></HEAD>
<BODY>
Michael, I guess your question is for James=20
? Regards KS -----Original Message----- From:=20
snort-users-admin@lists.sourceforge.net [<A=20
href=3D"mailto:snort-users-admin@lists.sourceforge.net">mailto:snort-user=
s-admin@lists.sourceforge.net</A>]On=20
Behalf Of Michael Steele Sent: Saturday, November 15, 2003 8:46 =
AM To:=20
snort-users@lists.sourceforge.net Subject: RE: [Snort-users] RE: =
Attack on=20
snort running in Public Zone KS, Is this is a real =
solution or=20
just a waste of bandwidth? Maybe there was a point here I didn't=20
get? Cheers... -Michael Steele --  System =
Engineer /=20
Security Support Technician      <A=20
href=3D"mailto:michaels@winsnort.com">mailto:micha els@winsnort.com</A>&nb=
sp;    Website:=20
<A href=3D"http://www.winsnort.com"=20
target=3D_blank>http://www.winsnort.com</A>  Snort: Open Source =
Network=20
IDS - <A href=3D"http://www.snort.org"=20
target=3D_blank>http://www.snort.org</A> > -----Original=20
Message----- > From: snort-users-admin@lists.sourceforge.net [<A=20
href=3D"mailto:snort-users-">mailto:snort-users-</A> >=20
admin@lists.sourceforge.net] On Behalf Of james > =
Sent:=20
Friday, November 14, 2003 4:54 PM > To:=20
snort-users@lists.sourceforge.net > Subject: Re: [Snort-users] RE: =
Attack=20
on snort running in Public Zone > > Well, don't run in on a =
OS that=20
can be DoS'ed. > > > ----- Original Message =
----- >=20
From: "KS" <kanwaljeet@emind.com> > To:=20
<snort-users@lists.sourceforge.net> > Sent: Tuesday, =
November 11,=20
2003 8:15 AM > Subject: [Snort-users] RE: Attack on snort running =
in=20
Public Zone > > > : Is anyone out there who can help=20
???????? > : > : > : -----Original =
Message----- > :=20
From: KS [<A=20
href=3D"mailto:kanwaljeet@emind.com">mailto:kanwal jeet@emind.com</A>] =
> :=20
Sent: Monday, November 10, 2003 8:48 PM > : To:=20
snort-users@lists.sourceforge.net > : Subject: Attack on snort =
running in=20
Public Zone > : > : > :   Helllo =
Everybody. >=20
: > :   I have snort running on win2k and it is working =
fine so=20
far.I had > placed > : it in DMZ to monitor the malicious =
traffic=20
passing through firewall and > Now > : i want to put another =
snort=20
win2k system in Public zone i.e in between > my > : router =
and=20
firewall so i can know which traffic is actually hitting the > : =
outside=20
interface of my firewall. > :   My concern is :  =
Since my=20
snort system ( win2k ) is gonna be on public > IP > : =
address , what=20
will happen if somebody runs a Denial of service attack > on =
my > :=20
snort system itself. > :   How can i be sure that my =
snort=20
system running on win2k is safe from > DOS > : attack =
? >=20
: > :   Thanks > :   KS >=20
: > > >=20
------------------------------------------------------- > This SF. =
Net=20
email is sponsored by: GoToMyPC > GoToMyPC is the fast, easy and =
secure=20
way to access your computer from > any Web browser or wireless =
device.=20
Click here to Try it Free! > <A=20
href=3D"https://www.gotomypc.com/tr/OSDN/AW/Q4_2003/t/g22lp?Target=3Dmm/g=
22lp.tmpl"=20
target=3D_blank>https://www.gotomypc.com/tr/OSDN/AW/...t/g22lp?Targe=
t=3Dmm/g22lp.tmpl</A> >=20
_______________________________________________ > Snort-users =
mailing=20
list > Snort-users@lists.sourceforge.net > Go to this URL to =
change=20
user options or unsubscribe: > <A=20
href=3D"https://lists.sourceforge.net/lists/listinfo/snort-users"=20
target=3D_blank>https://lists.sourceforge.net/lists/listinfo/snort-users<=
/A> >=20
Snort-users list archive: > <A=20
href=3D"http://www.geocrawler.com/redir-sf.php3?list=3Dsnort-users"=20
target=3D_blank>http://www.geocrawler.com/redir-sf.p...=3Dsnort-user=
s</A> ------------------------------------------------=
------- This=20
SF. Net email is sponsored by: GoToMyPC GoToMyPC is the fast, easy =
and secure=20
way to access your computer from any Web browser or wireless device. =
Click=20
here to Try it Free! <A=20
href=3D"https://www.gotomypc.com/tr/OSDN/AW/Q4_2003/t/g22lp?Target=3Dmm/g=
22lp.tmpl"=20
target=3D_blank>https://www.gotomypc.com/tr/OSDN/AW/...t/g22lp?Targe=
t=3Dmm/g22lp.tmpl</A> ____________________________________________ ___<=
BR>Snort-users=20
mailing list Snort-users@lists.sourceforge.net Go to this URL to =
change=20
user options or unsubscribe: <A=20
href=3D"https://lists.sourceforge.net/lists/listinfo/snort-users"=20
target=3D_blank>https://lists.sourceforge.net/lists/listinfo/snort-users<=
/A> Snort-users=20
list archive: <A=20
href=3D"http://www.geocrawler.com/redir-sf.php3?list=3Dsnort-users"=20
target=3D_blank>http://www.geocrawler.com/redir-sf.p...=3Dsnort-user=
s</A> </BODY></HTML>

------=_NextPart_000_0060_01C3AB5D.D61DA0C0--

-------------------------------------------------------
This SF. Net email is sponsored by: GoToMyPC
GoToMyPC is the fast, easy and secure way to access your computer from
any Web browser or wireless device. Click here to Try it Free!
https://www.gotomypc.com/tr/OSDN/AW/...=mm/g22lp.tmpl
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode