Re: snort inline mode and bridge

yep, that is one of the thing that I considered initially and didn't use
reload, does pulledpork update shared object rules ?

On Tue, Nov 1, 2016 at 11:48 AM, Y M <[email protected]> wrote:

> Keep in mind that updating shared object rules require restarting Snort.
> If shared object rules are updated and then snort is reloaded you will see
> error/warning messages while Snort is running. Just something to keep in
> mind if you observe the messages.
>
>
> YM
>
>
> ------------------------------
> *From:* Vincent Li <[email protected]>
> *Sent:* Thursday, October 27, 2016 8:45 PM
> *To:* Russ
> *Cc:* [email protected]
> *Subject:* Re: [Snort-devel] snort inline mode and bridge
>
> thanks! I guess daily signatures update is reloadable config for snort
> reload, so I will just use reload.
>
> On Thu, Oct 27, 2016 at 3:51 AM, Russ <[email protected]> wrote:
> >
> >
> > On 10/26/16 5:02 PM, Vincent Li wrote:
> >>
> >> it is not a problem, but some optimal improvement I would like to see.
> >> I have a lower end PC with two NIC running snort IPS bridge mode
> >> between my ISP modem and my  router at home.  I use pulledpork to
> >> update signatures every day and I scripted snort to restart to take
> >> the updated signatures after new signatures finishing downloading. the
> >> snort restart takes about 5  minutes to finish and during these 5
> >> minutes period, my home Internet is down since snort start the DAQ
> >> bridge after  SnortInit which take most of the time I think. btw I
> >> have not tried snort reload
> >
> > You should try reload, that is exactly what it is for.  Snort will keep
> > running during the reload so you don't have that downtime.
> >>
> >>
> >> my question is : can the DAQ bridge be started earlier in the snort
> >> startup process, maybe before SnortInit , so that traffic can be
> >> passed through early to reduce the network connectivity downtime to
> >> minimum.
> >
> > Snort has "fail open" support during startup because some initialization
> > must be done after opening the DAQ interfaces. During that time, which is
> > typically very brief, it will pass packets so your network remains
> > functional.  However, most of the startup time is prior to the fail open
> > state.  The change you suggest is possible but reload should make it
> > unnecessary.
> >
> >>
> >> let me know if I made myself clear :)
> >>
> >>
> >>
> >> Thanks
> >>
> >> Vincent
> >>
> >> On Tue, Oct 25, 2016 at 11:31 AM, Russ <[email protected]> wrote:
> >>>
> >>> Please restate the original problem.  I don't think fail open is what
> >>> you are after.
> >>>
> >>> On 10/25/16 2:03 PM, Vincent Li wrote:
> >>>>
> >>>> On Thu, Oct 13, 2016 at 8:26 PM, Y M <[email protected]> wrote:
> >>>>>
> >>>>> Hello Vincent,
> >>>>>
> >>>>>
> >>>>> I haven't tried this before, but when building Snort, there is this
> >>>>> build
> >>>>> option:
> >>>>>
> >>>>>
> >>>>> "--enable-inline-init-failopen  Enable Fail Open during
> initialization
> >>>>> for
> >>>>> Inline Mode (adds pthread support implicitly)"
> >>>>>
> >>>>>
> >>>>> Have you tried this? I would be interested to know if this achieves
> >>>>> what you
> >>>>> need.
> >>>>>
> >>>> so I tried to build snort with --enable-inline-init-failopen, it did
> >>>> not sovle the problem I have.  it looks to me the InlineFailOpen is
> >>>> called near to the end of  SnortMain after SnortInit (which take most
> >>>> of the time during snort restart) and before PacketLoop();
> >>>>
> >>>> I tried to hack the code to call InlineFailOpen before SnortInit, but
> >>>> I had memory segment fault after starting up snort and pass traffic
> >>>> through it, I assume some memory has to be allocated before starting
> >>>> up the DAQ bridge, any further clue?
> >>>>
> >>>> maybe some improvement needed in line with the idea of InlineFailOpen
> ?
> >>>>
> >>>> Thanks
> >>>>
> >>>> Vincent
> >>>>
> >>>>
> >>>> ------------------------------------------------------------
> ------------------
> >>>> The Command Line: Reinvented for Modern Developers
> >>>> Did the resurgence of CLI tooling catch you by surprise?
> >>>> Reconnect with the command line and become more productive.
> >>>> Learn the new .NET and ASP.NET CLI. Get your free copy!
> >>>> http://sdm.link/telerik
> >>>> _______________________________________________
> >>>> Snort-devel mailing list
> >>>> [email protected]
> >>>> https://lists.sourceforge.net/lists/listinfo/snort-devel
> >>>> Archive:
> >>>> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel
> >>>>
> >>>> Please visit http://blog.snort.org for the latest news about Snort!
> Snort Blog <http://blog.snort.org/>
> blog.snort.org
> Just released: Snort Subscriber Rule Set Update for 10/25/2016 We welcome
> the introduction of the newest rule release from Talos. In this release we
> introduced 27 new ...
>
>
> >>>
> >>>
> >>>
> >>> ------------------------------------------------------------
> ------------------
> >>> The Command Line: Reinvented for Modern Developers
> >>> Did the resurgence of CLI tooling catch you by surprise?
> >>> Reconnect with the command line and become more productive.
> >>> Learn the new .NET and ASP.NET CLI. Get your free copy!
> >>> http://sdm.link/telerik
> >>> _______________________________________________
> >>> Snort-devel mailing list
> >>> [email protected]
> >>> https://lists.sourceforge.net/lists/listinfo/snort-devel
> Snort-devel Info Page - lists.sourceforge.net
> <https://lists.sourceforge.net/lists/listinfo/snort-devel>
> lists.sourceforge.net
> Your email address: Your name (optional): You may enter a privacy password
> below. This provides only mild security, but should prevent others from
> messing with ...
>
>
> >>> Archive:
> >>> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel
> >>>
> >>> Please visit http://blog.snort.org for the latest news about Snort!
> Snort Blog <http://blog.snort.org/>
> blog.snort.org
> Just released: Snort Subscriber Rule Set Update for 10/25/2016 We welcome
> the introduction of the newest rule release from Talos. In this release we
> introduced 27 new ...
>
>
> >
> >
>
> ------------------------------------------------------------
> ------------------
> The Command Line: Reinvented for Modern Developers
> Did the resurgence of CLI tooling catch you by surprise?
> Reconnect with the command line and become more productive.
> Learn the new .NET and ASP.NET CLI. Get your free copy!
> http://sdm.link/telerik
> _______________________________________________
> Snort-devel mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/snort-devel
> Snort-devel Info Page - lists.sourceforge.net
> <https://lists.sourceforge.net/lists/listinfo/snort-devel>
> lists.sourceforge.net
> Your email address: Your name (optional): You may enter a privacy password
> below. This provides only mild security, but should prevent others from
> messing with ...
>
>
> Archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel
>
> Please visit http://blog.snort.org for the latest news about Snort!
> Snort Blog <http://blog.snort.org/>
> blog.snort.org
> Just released: Snort Subscriber Rule Set Update for 10/25/2016 We welcome
> the introduction of the newest rule release from Talos. In this release we
> introduced 27 new ...
>
>
>

------------------------------------------------------------------------------
Developer Access Program for Intel Xeon Phi Processors
Access to Intel Xeon Phi processor-based developer platforms.
With one year of Intel Parallel Studio XE.
Training and support from Colfax.
Order your platform today. http://sdm.link/xeonphi

_______________________________________________
Snort-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/snort-devel

Archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel

Please visit http://blog.snort.org for the latest news about Snort!