From: Stephen J Smoogen <smoogen@lanl.gov>
To: Khanh Tran <khanh@slc.edu>
Cc: Daniel Chemko <dchemko@smgtec.com>, netfilter@lists.netfilter.org
Subject: Re: virus scanning with iptables
Date: Fri, 10 Sep 2004 09:34:27 -0600 [thread overview]
Message-ID: <4141C983.5050409@lanl.gov> (raw)
In-Reply-To: <01CEA3A5B8B2D511890F0002A5870AEC02CE644C@exchange.admin.slc.edu>
Khanh Tran wrote:
> How about port scanning clients behind from the firewall? Suggestions?
> I'm thinking of something that could be scripted to append an iptables
> rule to block the MAC address of the offending client, then notify me.
> Am I looking at an NMAP plugin possibly?
>
You would probably want to have something like SNORT tied into iptables.
Have something like SNORT look for certain alerts and then when it
finds them it sends a 'signal' to a daemon on the firewall that inserts
a DROP rule for that IP address in a 'dynamic chain'.
--
Stephen John Smoogen | CCN-5 Security Team
LANL SIRT Team Leader | SMTP: smoogen@lanl.gov
Los Alamos National Laboratory | Voice: 505.664.0645
Ta-03 SM-1498 MS: B255 DP 10S | FAX: 505.665.7793
Los Alamos, NM 87545 |
next prev parent reply other threads:[~2004-09-10 15:34 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2004-09-10 0:36 virus scanning with iptables Khanh Tran
2004-09-10 15:34 ` Stephen J Smoogen [this message]
2004-09-10 15:54 ` rruegner
2004-09-10 15:50 ` Stephen J Smoogen
2004-09-10 16:37 ` Jose Maria Lopez
-- strict thread matches above, loose matches on Subject: below --
2004-09-09 23:26 Daniel Chemko
2004-09-10 7:49 ` Victor Julien
2004-09-09 23:09 Khanh Tran
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4141C983.5050409@lanl.gov \
--to=smoogen@lanl.gov \
--cc=dchemko@smgtec.com \
--cc=khanh@slc.edu \
--cc=netfilter@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.