<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;">
<p><span id="ms-rterangepaste-start"></span><span dir="ltr"><font color="black" face="Calibri,Arial,Helvetica,sans-serif" size="3"><span style="font-size:12pt;background-color:white;">Ubuntu 14.04 is Jessie, not Wheezy. Changing my OS is not really an option.</span></font></span><span id="ms-rterangepaste-end"></span><br>
</p>
<br>
<br>
<div style="color: rgb(0, 0, 0);">
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" color="#000000" face="Calibri, sans-serif"><b>From:</b> Leonard Jacobs <ljacobs@netsecuris.com><br>
<b>Sent:</b> Wednesday, January 27, 2016 5:09 PM<br>
<b>To:</b> John Devine<br>
<b>Subject:</b> Re: [Oisf-users] IPS alternatives to Snort's guardian?</font>
<div> </div>
</div>
<div>We run Ubuntu 14.04 LTS, with Suricata in AF-Packet mode as IPS. It is all written up in the documentation. No firewall needed in that mode.<br>
<br>
<font face="Arial" size="4"></font><br>
<br>
<br>
<div><strong>From: </strong>John Devine <john.devine@nuspire.com> <br>
<strong>To: </strong>Leonard Jacobs <ljacobs@netsecuris.com>, "oisf-users@lists.openinfosecfoundation.org" <oisf-users@lists.openinfosecfoundation.org>
<br>
<strong>Sent: </strong>1/27/2016 4:07 PM <br>
<strong>Subject: </strong>Re: [Oisf-users] IPS alternatives to Snort's guardian? <br>
<br>
<blockquote class="mcnt mori" style="margin:0 0 0 .8ex; border-left:1px solid #CCC; padding-left:1ex">
<div class="mcnt">
<div id="mcntdivtagdefaultwrapper" style="font-size:12pt; color:#000000; background-color:#FFFFFF; font-family:Calibri,Arial,Helvetica,sans-serif">
<p>I am running the wheezy backport and according to the documentation I've read Suricata needs to be in nfqueue mode to run as an IPS. In order for that to work it needs to have traffic forwarded through it and I don't want to have that be the only active
firewall on the box because I have other systems (proxy etc.) tied in to iptables. I would prefer to have an IDS essentially as a packet sniffer and have a separate piece of software create iptables rules based on those alerts. Currently I am doing exactly
that with Snort (IDS) and Guardian (IPS). Though I am currently working with Suricata to see if I can integrate it in this regard ultimately to replace Snort.<br>
</p>
<br>
<br>
<div style="color:rgb(0,0,0)">
<hr style="display:inline-block; width:98%">
<div id="mcntdivRplyFwdMsg"><font style="font-size:11pt" color="#000000" face="Calibri, sans-serif"><b>From:</b> Leonard Jacobs <ljacobs@netsecuris.com><br>
<b>Sent:</b> Wednesday, January 27, 2016 4:59 PM<br>
<b>To:</b> John Devine; oisf-users@lists.openinfosecfoundation.org<br>
<b>Subject:</b> Re: [Oisf-users] IPS alternatives to Snort's guardian?</font>
<div> </div>
</div>
<div>As a OISF Board Member, why would you not want to run Suricata in IPS mode? AF-Packet mode works great as IPS.<br>
<font face="Arial" size="4"></font><br>
<br>
<br>
<div><strong>From: </strong>John Devine <john.devine@nuspire.com> <br>
<strong>To: </strong>"oisf-users@lists.openinfosecfoundation.org" <oisf-users@lists.openinfosecfoundation.org>
<br>
<strong>Sent: </strong>1/27/2016 2:10 PM <br>
<strong>Subject: </strong>[Oisf-users] IPS alternatives to Snort's guardian? <br>
<br>
<blockquote class="mcntmcnt mcntmori" style="margin:0 0 0 .8ex; border-left:1px solid #CCC; padding-left:1ex">
<div class="mcntmcnt">
<div id="mcntmcntdivtagdefaultwrapper" style="font-size:12pt; color:#000000; background-color:#FFFFFF; font-family:Calibri,Arial,Helvetica,sans-serif">
<p>Hi all,<br>
<br>
Currently I run snort as an IDS and guardian as an IPS. I am looking for alternatives to guardian for IPS software because guardian does not allow me to manually unblock specific IP addresses or change the duration of which something is blocked without some
hassle or custom scripts. I have been messing around with Suricata and have successfully got it running both in IDS and IPS mode and alerting successfully. Right now I want to run Suricata as an IDS and have some other open source software to run as my IPS.
Are there any decent alternatives to guardian.pl which allow me to manually unblock specific IP addresses and change the length of time in which something is blocked? I am looking for a good IPS 'companion' to run in tandem with Suricata.<br>
<br>
Thanks in advance<br>
</p>
</div>
</div>
<br>
<br>
_______________________________________________<br>
Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org<br>
Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/<br>
List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users<br>
Suricata User Conference November 9-11 in Washington, DC: http://oisfevents.net</blockquote>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</div>
</body>
</html>