Home/ Questions/Q 8311151
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-08T19:43:01+00:00

I am using snort_inline and I forwarded all the packets using iptables to the

  • 0

I am using “snort_inline” and I forwarded all the packets using
iptables to the QUEUE so that snort_inline can pick them up for
inspection and drop/alert depending on the rules.
But does “Snort” when run in inline mode take in packets from iptables
too? What is the difference between Snort and Snort_inline when it
comes to blocking packets ?
I observe that when I run “Snort” without using iptables, somehow my
packets are getting dropped.
Would be helpful if someone clarifies this for me.
Thanks !

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    snort_inline is depreciated and you should use Snort with DAQ. Snort with DAQ can handle the same Snort “dropping” of packets.

    There are several different inline modes that DAQ will support, iptables (nfqueue) being one of them.

    • 0