Tag Info

New answers tagged

0

Since both Snort and Iptables getting the packets from interface so both will process the packets and both will trigger the action which is given by you in the rule. There is no need to use Iptables if you are running Snort. Create a rule for Snort which you have configured Iptables and set the rule action Drop in Snort rule. It will do the same work as ...


1

Nevermind... the alerts are logged in the same directory. However the problem seems to be that even if I'm using the default configuration file, I need to use the -c parameter


1

It depends on your reqirement, where you are going to use your or snort IDPS. It means, If your DMZ or network is getting attacked more frequently then you should go for Emerging Threat Pro rules because it will be updated every day so you will get protected by new attacks or might be zero day. In the other hand snort VRT paid version rules will be updated ...



Top 50 recent answers are included