fwsnort
fwsnort translates snort rules into an equivalent iptables ruleset. By making use of the iptables string match module, fwsnort can detect application layer signatures which exist in many snort rules. fwsnort adds a --hex-string option to iptables, which allows snort rules that contain hex characters to be input directly into iptables rulesets without modification. In addition, fwsnort makes use of the IPTables::Parse Perl module in order to (optionally) restrict the snort rule translation to only those rules that specify traffic that could potentially be allowed through an existing iptables policy.
| Tags | Logging Monitoring Networking Firewalls |
|---|---|
| Licenses | GPL |
| Operating Systems | POSIX Linux |
| Implementation | C Perl Unix Shell |
Recent releases
- 22 Dec 2012 04:27
Release Notes: This release adds a new comprehensive test suite, a faster iptables/ip6tables capabilities testing routine, and fixes for hex string encoding for some Snort content matches with syntax-busting characters.
- 29 Apr 2012 17:53
Release Notes: This release switches the default policy load stance to load all translated Snort rules into the running iptables policy by default. This was made possible after fwsnort made use of the iptables-save format for policy instantiation. Updated to use the NetAddr::IP module from CPAN. A bugfix for translated ICMP rules and ICMP type requirements in recent versions of iptables.
- 02 Sep 2011 22:04
Release Notes: A bugfix for the 'Couldn't load target' error seen on some Linux systems. A bugfix for interpreting pattern ordering in Snort rules with relative pattern matches. Updated to the latest Emerging Threats rule set.
- 29 Jul 2011 06:04
Release Notes: Snort fast_pattern support and iptables multiport match support were added. The --QUEUE and --NFQUEUE modes were enhanced. Support was added for the conntrack module for connection tracking. Case-insensitive pattern matching was added via the --icase argument to the iptables string match extension. A couple of minor bugs were fixed.
- 09 Jan 2010 08:08
Release Notes: Support for ip6tables was added so that fwsnort can apply Snort rules to IPv6 traffic. The ability to create Perl commands that print application layer data that matches Snort rules was added via a new "--include-perl-triggers" argument. Better support for configuration variables within the fwsnort.conf file was added.
michaelrash
21 Apr 2003 06:10
Heartbeat
- Popularity Score
- 264.53
- Vitality Score
- 24.43
- Subscriptions
- 74
