netfilter/iptables synproxy; need help deciding

Wed Oct 8 15:24:32 UTC 2014

On 10/08/14 17:54, Roland Dobbins wrote:
> On Oct 8, 2014, at 9:43 PM, Paige Thompson <paigeadele at gmail.com> wrote:
>
>> Any thoughts on this are appreciated,
> <http://mailman.nanog.org/pipermail/nanog/2010-January/016747.html>
>
> <https://app.box.com/s/e6hdt0iansu1sdb6m42t> pp. 30-36.
>
> ----------------------------------------------------------------------
> Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>
>
>                    Equo ne credite, Teucri.
>
>     		   	  -- Laocoön
>
Re pp: 30-36 I think I catch your drift (ie: using cisco netflow to
detect a synflood?) but would you care to summarize just in case because
I am not this savvy, but would like to understand.

Also in regards to snort inline, I've been trying to figure out whether
or not Snort/DAQ/NFQ (netfilter) is appropriate or not. I cannot get
this to work but it seems like on a gatway, for example where I have all
of this iptables stuff that NFQ would be appropriate and would probably
help with all of the false positives (3 way handshake and a couple of
others) I see when trying to use the pcap driver (the only one that will
work.)