IP Blacklisting in Snort
Summary: Marty Roesch wrote a new preprocessor for Snort 2.8.4.1 that implements IP blocklisting, aimed at improving performance for users who run Snort as a pseudo firewall. The patch builds successfully on OS X, Fedora, Ubuntu and FreeBSD, and the post labels the code EXPERIMENTAL and directs users to the README.iplist in the tarball.
Bottom line: The patch comes from Snort's original author as experimental code with a README of requirements, so anyone running Snort as a pseudo firewall is weighing a performance gain against deploying untested blocking logic in their detection path.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026