RE: [Snort-users] Country blocking?

Anything from RIPE.NET could be blocked as far as I can tell....

--just my 2 cents.
__________________________________________________ ____________________
Lewis Donofrio@umich.edu College of Literature, Science, & Arts
1007 East Huron, Room 201, BetaID:243340 Cell: (734) 323-8776
Ann Arbor,MI 48104-1690 www.umich.edu/~donofrio Fax: (734) 647-8333
----------------------------------------------------------------------
() ascii ribbon campaign - against html mail
/\ [http://arc.pasp.de/]

-----Original Message-----
From: snort-users-admin@lists.sourceforge.net
[mailto:snort-users-admin@lists.sourceforge.net] On Behalf Of Alex Kirk
Sent: Tuesday, January 18, 2005 8:56 AM
To: mdpeters
Cc: snort-users@lists.sourceforge.net
Subject: Re: [Snort-users] Country blocking?

That's probably a task that's better suited for your firewall, if you're
just dropping all connections from a country, irrespective of what they
contain.

That being said, though, it can be difficult to block based on
geographic region, let alone a specific country. IP address ranges are
somewhat fluid, and geolocation is still an inexact science. Unless I'm
unaware of some new technology out there, chances are good that your
attempt to block by country will result in some connections from it
still getting through, along with the blocking of some things that
aren't from that country -- especially since there's nothing in most
packets that associate them with a specific country. I mean, it's not
like you could to try to use Snort to block anything that contained the
Chinese character set, since you'd miss messages coming from China in
English, but zap messages in Chinese from, say, Cambodia, Vietnam, or
even America. It gets worse when dealing with straight TCP/IP -- you
wouldn't even have that kind of a clue.

If anyone else has a solution to this, I'm all ears, but I have a
feeling you're out of luck here.

Alex Kirk
Research Analyst
Sourcefire, Inc.

> Could anyone advise me on how to block a large IP address space using=20
> Snort-inline? For example, I would like to drop all connections=20
> originating from China.
>



-------------------------------------------------------
The SF.Net email is sponsored by: Beat the post-holiday blues Get a FREE
limited edition SourceForge.net t-shirt from ThinkGeek.
It's fun and FREE -- well, almost....http://www.thinkgeek.com/sfshirt
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...=3Dsnort-users


-------------------------------------------------------
The SF.Net email is sponsored by: Beat the post-holiday blues
Get a FREE limited edition SourceForge.net t-shirt from ThinkGeek.
It's fun and FREE -- well, almost....http://www.thinkgeek.com/sfshirt
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users