[Snort-devel] Where to do the stuff?

Todd Lewis tlewis at ...120...
Wed Jan 24 11:51:19 EST 2001


On Wed, 24 Jan 2001, Brian wrote:

> Is snort the place to do this?  I would think the best place to put those 
> types of things would be  on a firewall.  You wouldn't want to put a verdict
> on an ongoing session.   Just use RESP or REACT.  OF course, react needs some
> work, but the idea is there.

The division between NIDS and firewalling is archaic.  Snort is tearing
down the wall between the two; welcome to the revolution.  For more
info, check the snort-devel archives for descriptions of what I'm doing.
If you disapprove, then don't use it.

Anyone else have a suggestion for where my logic should go?  I just
fixed my code and got the parsing, etc., all working, so that should be
the last piece before my 1.6.3 mods are complete.

--
Todd Lewis                                       tlewis at ...120...

  God grant me the courage not to give up what I think is right, even
  though I think it is hopeless.          - Admiral Chester W. Nimitz





More information about the Snort-devel mailing list