Re: [Snort-users] Slow down TCP connections

El dom, 29 de 08 de 2004 a las 18:57, pfeito escribió:
> Hi Guys,
>
> I'm searching for pro-active plug-ins for Snort.
>
> Right know, I've just compiled and installed snort 2.2.0 with flexresp2
> support. I'm about to test flexresp2 capabilities, but It seems to have no
> support for slowing down TCP connections (i.e. for slowing down TCP Scans
> for instance...)
>
> Do you know any plug-in that allows Snort to slow down TCP connections speed
> (i.e. resize TCP window size) ?
>
> Thanks,
> -pfeito

Wouldn't it be more useful to use iptables or iproute2 for this work?
With iptables you can do something like:

iptables -A INPUT -i <if> -p tcp --syn -m limit --limit 20/s -j ACCEPT
(accept 20 SYN connections per second, you can also use the burst
option to make it more suitable)

and with iproute2 you can use the QOS capabilities of the system to
limit the number of TCP connections. This is the correct option to
slow down the number of TCP connections, but it's a bit complicated.
You can read the Advanced Routing HOWTO that explains it all very
deeply.

--
Jose Maria Lopez Hernandez
Director Tecnico de bgSEC
jkerouac@bgsec.com
bgSEC Seguridad y Consultoria de Sistemas Informaticos
http://www.bgsec.com
ESPAÑA

The only people for me are the mad ones -- the ones who are mad to live,
mad to talk, mad to be saved, desirous of everything at the same time,
the ones who never yawn or say a commonplace thing, but burn, burn, burn
like fabulous yellow Roman candles.
-- Jack Kerouac, "On the Road"



-------------------------------------------------------
This SF.Net email is sponsored by BEA Weblogic Workshop
FREE Java Enterprise J2EE developer tools!
Get your free copy of BEA WebLogic Workshop 8.1 today.
http://ads.osdn.com/?ad_id=5047&alloc_id=10808&op=click
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users