What is snort_inline?
snort_inline is basically a modified version of
Snort
that accepts packets from
iptables and IPFW
via
libipq(linux) or divert sockets(FreeBSD), instead of
libpcap. It
then uses new rule types (drop, sdrop, reject) to tell
iptables/IPFW whether the packet should be dropped, rejected, modified, or
allowed
to pass based on a snort rule set. Think of this as an
Intrusion Prevention System (IPS) that uses existing Intrusion
Detection System (IDS) signatures to make decisions on packets that
traverse snort_inline.
Contact Info
The code is currently maintained by
William
Metcalf and
Victor Julien. Major contributions have also come from Dave Remien and Nick Rogness. Check out the monitored
snort_inline
mailing list for discussions on bugs and enhancements. You
must become a member in order to be able to send and receive messages
to and from this mailing list. This was done in order to reduce
the amount of spam. Click
here and follow the directions to
become a member.
