<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
Hi Eric, thanks for hints and tips.
<div><br>
</div>
<div>actually i have this two queue:</div>
<div>iptables -A FORWARD -i br0 -j NFQUEUE --queue-bypass --queue-num 1 (Network 192.168.1.0/24)</div>
<div>iptables -A FORWARD -i br2 -j NFQUEUE --queue-bypass --queue-num 2 (Network 192.168.100.0/24) </div>
<div><br>
</div>
<div><span style="white-space: pre-wrap;">I will not lose this traffic on port 6101, otherwise my backup software does not work (sure drop this</span> traffic in IPS mode)<span style="white-space: pre-wrap;">.</span></div>
<div>
<div class="force_dir" style="white-space: pre-wrap; "><font lang="en">Only suri should not watch the traffic, so that the backup is successful.</font></div>
</div>
<div><br>
</div>
<div><span style="white-space: pre-wrap; ">How should I fix this with your example?</span></div>
<div><span style="white-space: pre-wrap; ">thx</span></div>
<div><span style="white-space: pre-wrap; ">Stefan</span></div>
<div> <br>
<div>
<div>Am 13.03.2013 um 15:07 schrieb Eric Leblond <<a href="mailto:eric@regit.org">eric@regit.org</a>></div>
<div>:</div>
<br class="Apple-interchange-newline">
<blockquote type="cite">Hi,<br>
<br>
On Wed, 2013-03-13 at 13:57 +0000, Stefan Sabolowitsch wrote:<br>
<blockquote type="cite">Hi Victor, thanks for your fast answer.<br>
But how can i "exclude" such traffic /alarming / drop (IPS-Mode) , will threshold.conf here help ?<br>
</blockquote>
<br>
Just queue the packet you want with NFQUEUE. It could looks like:<br>
iptables -I FORWARD -s 192.168.1.0/24 -p tcp --dport 6101 -j NFQUEUE<br>
iptables -I FORWARD -s 192.168.1.0/24 -p tcp --sport 6101 -j NFQUEUE<br>
...<br>
<br>
BR,<br>
<blockquote type="cite">thx<br>
Stefan<br>
<br>
Am 13.03.2013 um 14:50 schrieb Victor Julien <<a href="mailto:lists@inliniac.net">lists@inliniac.net</a>><br>
:<br>
<br>
<blockquote type="cite">On 03/13/2013 12:05 PM, Stefan Sabolowitsch wrote:<br>
<blockquote type="cite">Hi all, i have here sure 1.4.1 in nfq / inline mode.<br>
I use always this filter (exclude Backup stream server <-> client):<br>
<br>
not ((src net 192.168.1.0/24 and (dst port 6101 or dst port 10000 or dst portrange 1025-1100)) or (src net 192.168.100.0/24 and (src port 6101 or src port 10000 or src portrange 1025-1100)))<br>
<br>
But i found this in fast.log.<br>
<br>
03/13/2013-00:18:44.414738 [**] [1:648:7] GPL SHELLCODE x86 NOOP [**] [Classification: Executable Code was Detected] [Priority: 1] {TCP} 192.168.100.20:1025 -> 192.168.1.37:61817<br>
<br>
start options:<br>
Executing: suricata --user sguil --group sguil -c /etc/nsm/Serrig-intern/suricata.yaml -F /etc/nsm/Serrig-intern/bpf.filt -q 1 -l /nsm/sensor_data/Serrig-intern<br>
<br>
Without inline mode, this filter will work.<br>
</blockquote>
<br>
This is correct. It will not work in IPS mode. I have just created bug<br>
777 to make sure we generate an error/warning in the future.<br>
<br>
-- <br>
---------------------------------------------<br>
Victor Julien<br>
<a href="http://www.inliniac.net/">http://www.inliniac.net/</a><br>
PGP: http://www.inliniac.net/victorjulien.asc<br>
---------------------------------------------<br>
<br>
_______________________________________________<br>
Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org<br>
Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/<br>
List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users<br>
OISF: http://www.openinfosecfoundation.org/<br>
<br>
</blockquote>
<br>
<br>
_______________________________________________<br>
Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org">
oisf-users@openinfosecfoundation.org</a><br>
Site: <a href="http://suricata-ids.org">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/">
http://suricata-ids.org/support/</a><br>
List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users">
https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
OISF: <a href="http://www.openinfosecfoundation.org/">http://www.openinfosecfoundation.org/</a><br>
</blockquote>
<br>
-- <br>
Eric Leblond <<a href="mailto:eric@regit.org">eric@regit.org</a>><br>
Blog: <a href="https://home.regit.org/">https://home.regit.org/</a><br>
<br>
<br>
</blockquote>
</div>
<br>
</div>
</body>
</html>