Every few weeks the same question comes up: what is the difference between Snort in inline mode and Snort_inline. This makes sense, because the Snort_inline documentation and website fail to explain it. In this post I will try to highlight the main differences. In general I can say that we try to develop Snort_inline as a patchset on top of Snort. Snort_inline is focused at improving the inline part of Snort. Originally of course, Snort’s inline capabilities were developed in the Snort_inline project. With Snort 2.3.0RC1 they were merged into mainline Snort.
We did a number of things to make Snort_inline a little more convenient for inline users.
- inline is enabled by default in ./configure
- we got rid of libnet 1.0.2a, switched to libdnet 1.1 instead
- a snort_inline specific manual page was added, as well as some extra docs
- a example configuration file for inline use is supplied
- we support Linux’ new queue’ing mechanism called nfqueue. This was contributed by Nitro Security. Nfqueue supports running multiple copies of Snort_inline to take advantage of SMP and reduce risk of denial of service when Snort_inline should crash.
- stickydrop preprocessor enables you to add options to the rules to block an ipaddress for a configurable amount of time
- bait-and-switch preprocessor (Linux only) allows you to redirect traffic from a host to a honeypot based on the rules
- clamav preprocessor is included (you still need to pass –enable-clamav to ./configure)
- reinject action for FreeBSD: reinjects an accepted packet into the ipfw list at a specific rule number
Improved for inline use
- reject action can send RST packets to both source and destination
- stream4 can drop attacks detected in the reassembled stream. It also enforces the TCP window. It implements a number of ideas from Vern Paxson on TCP reassembly, such as a limit on the number of out of order packets and bytes that are accepted in a stream.
- some fixes for FreeBSD
As the list shows, if you are interested in Snort running inline, using Snort_inline might be a better choice for you!