Re: Inline Mode

I have the ARM processor and inline is not listed
________________________________
From: Snort-users <[email protected]> on behalf of Len Dyck via Snort-users <[email protected]>
Sent: Wednesday, April 24, 2024 11:51
To: Guillaume - Libvert.fr <[email protected]>; Joel Esler <[email protected]>
Cc: [email protected] <[email protected]>
Subject: Re: [Snort-users] Inline Mode

I was able to get the list of all rule categories and create an SID management file, which worked fine, though the Auto-Flowbit category rules remained as alert.  Also, as new rules/categories are added, I would need to rerun/redo the SID management file.  Guess I'll just keep using Snort IPS in legacy mode.  Cheers.


On Wednesday, April 24, 2024 at 02:35:34 p.m. EDT, Joel Esler via Snort-users <[email protected]> wrote:


Much easier said than done.  Considering the majority of Snort users are IDS and only are functioning with one network card.

On Apr 19, 2024, at 12:15, Guillaume - Libvert.fr via Snort-users <[email protected]> wrote:

Right => Snort developers should indeed configure the application to drop bad packets by default



Le jeu. 18 avr. 2024 à 20:18, Len Dyck via Snort-users <[email protected]<mailto:Le%20jeu.%2018%20avr.%202024%20%C3%A0%2020:18,%20Len%20Dyck%20via%20Snort-users%20<<a%20href=>> a écrit :
Hi fellow snorters.  I have been unable to find concise instructions on how one would go about setting up a Snort interface to work in inline mode.  I have a basic understanding of the pieces, but I get stuck at the SID Management Configuration Lists.  The end result that I'm after is to configure all rules that are enabled to be set to drop instead of alert.  Appreciate the help.
_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

To unsubscribe, send an email to:
[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

_______________________________________________
Snort-users mailing list
[email protected]<mailto:[email protected]>
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

    To unsubscribe, send an email to:
    [email protected]<mailto:[email protected]>

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette