[Emerging-Sigs] Blocks based on IP alone

Joel Esler joel.esler at me.com
Tue Oct 19 18:25:35 EDT 2010


I run into this every once in awhile at customers now, however, having an
"Appliance" (with failopen, and easy configuration) is an easier argument
than Snort in "inline" mode might be for some companies.

But check out V-line taps from Net Optics.

J

On Sun, Oct 17, 2010 at 7:30 PM, Packet Hack <pckthck at gmail.com> wrote:

> On Sun, Oct 17, 2010 at 6:08 PM, Joel Esler <joel.esler at me.com> wrote:
>
>> I think it depends on how web sense is installed.
>>
>> I prefer the inline drop method as opposed to the "race condition" method
>> of flexresp.
>>
>
> So would I, but thats not politically feasible at this time. I'll write
> back and let the list
> know how it's working.
>
> -- pckthck
>
>
>
> _______________________________________________
> Emerging-sigs mailing list
> Emerging-sigs at emergingthreats.net
> http://lists.emergingthreats.net/mailman/listinfo/emerging-sigs
>
> Support Emerging Threats! Get your ET Stuff! Tshirts, Coffee Mugs and
> Lanyards
> http://www.emergingthreats.net/index.php/support-et-and-buy-et-schwag.html
>



-- 
Joel Esler
http://blog.joelesler.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.emergingthreats.net/pipermail/emerging-sigs/attachments/20101019/0f428c22/attachment.html


More information about the Emerging-sigs mailing list