Hey I have set up snort inline between two computers to tst it out, and I seem to be having trouble dropping packets. I have it set up with afpacket and from one computer I am creating and sending packets to the computer on the other side of the snout server, where I am running a wireshark to see if they get through. My rule for dropping is as follows:
drop 184.108.40.206 any -> $HOME_NET any (msg:"Hello";sid:12884774)
I know everything else is set up correctly as it still logs the packet i send through to the BASE web server, but from wireshark on the otherside, i can still see the packet going through. Please help. Thanks.
(Snort server is running debian, with latest versions of snort and DAQ)