This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

IPS issue

I ahve IPS on and all traffic is routed through it. I am using azuerues to download a CentOS dvd iso. I chenged the p2p group to drop for testing. I am getting alerts about the packets but i am downloading and uploading without incident. I ahve the up2date setup for every hour so it seems the snort defs need work..

This thread was automatically locked due to age.

Parents

0 Xeno over 20 years ago

Make sure you set the rules to block traffic. By default the rules might be set to aleart only.

Xeno
Cancel
Vote Up 0 Vote Down

Cancel
0 William Warren over 20 years ago in reply to Xeno

look in my post above..i changed them to drop.
Cancel
Vote Up 0 Vote Down

Cancel
0 Xeno over 20 years ago in reply to William Warren

Are you sure that the rules which are set to drop are reported in the log? Maybe another rule is matching and so generating the log entries.

Xeno
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Xeno over 20 years ago in reply to William Warren

Are you sure that the rules which are set to drop are reported in the log? Maybe another rule is matching and so generating the log entries.

Xeno
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 William Warren over 20 years ago in reply to Xeno

[ QUOTE ]
Are you sure that the rules which are set to drop are reported in the log? Maybe another rule is matching and so generating the log entries.

Xeno

[/ QUOTE ]
Xeno,

read my posts. I have the entire p2p groups set as drop. I can still p2p without isue. This needs to be addressed.
Cancel
Vote Up 0 Vote Down

Cancel
0 JimmyM over 20 years ago in reply to William Warren

The existing P2P rules in the Snort rules database (with documentation) don't mention azuerues specifically.
http://www.snort.org/cgi-bin/sigs-search.cgi?sid=P2P
Perhaps it uses a port/protocol/signature not implemented yet by snort.
Here's your opportunity to wrote your own rule!
Exciting times!
Cancel
Vote Up 0 Vote Down

Cancel
0 William Warren over 20 years ago in reply to JimmyM

possibly..but azuerus is a bit torrent client. So i am wondering why snort is unable to block it..
Cancel
Vote Up 0 Vote Down

Cancel