Software Release - fwsnort-1.1
07 Jan, 2010
The 1.1 release of fwsnort is ready for download.
This is a significant release that adds support for
ip6tables so
that SNORT ® inspection logic can be applied to IPv6 traffic within the
Linux kernel. This release also includes a new feature that allows fwsnort
to build perl commands interfaced with netcat that generate packet data that
matches Snort rules (for those that that can be faithfully
translated - see the --include-perl-triggers command line argument
and associated comments within the fwsnort.sh file).
Here is the complete fwsnort-1.1 ChangeLog:
- Added the ability to build an fwsnort policy that utilizes ip6tables instead of iptables. This allows fwsnort filtering and altering capabilities to apply to IPv6 traffic instead of just IPv4 traffic. To enable ip6tables usage, use the "-6" or "--ip6tables" command line arguments.
- Added the --include-perl-triggers command line argument so that translated Snort rules can easily be tested. This argument instructs fwsnort to include 'perl -e print ... ' commands as comments in the /etc/fwsnort/fwsnort.sh script, and these commands can be combined with netcat to send payloads across the wire that match Snort rules.
- Updated fwsnort to create logs in the /var/log/fwsnort/ directory instead of directly in the /var/log/ directory. The path is controlled by a new variable 'LOG_FILE' in the /etc/fwsnort/fwsnort.conf file.
- Added several variables in /etc/fwsnort/fwsnort.conf to control paths to everything from the config file to the snort rules path. Coupled with this is the ability to create variables within path components and fwsnort will expand them (e.g. 'CONF_DIR /etc/fwsnort; CONF_FILE $CONF_DIR/fwsnort.conf').
- Added --Last-cmd arg so that it is easy to rebuild the fwsnort.sh script with the same command line args as the previous execution.
