[Snort-devel] Where to do the stuff?

Todd Lewis tlewis at ...120...
Wed Jan 24 11:51:19 EST 2001

On Wed, 24 Jan 2001, Brian wrote:

> Is snort the place to do this?  I would think the best place to put those 
> types of things would be  on a firewall.  You wouldn't want to put a verdict
> on an ongoing session.   Just use RESP or REACT.  OF course, react needs some
> work, but the idea is there.

The division between NIDS and firewalling is archaic.  Snort is tearing
down the wall between the two; welcome to the revolution.  For more
info, check the snort-devel archives for descriptions of what I'm doing.
If you disapprove, then don't use it.

Anyone else have a suggestion for where my logic should go?  I just
fixed my code and got the parsing, etc., all working, so that should be
the last piece before my 1.6.3 mods are complete.

Todd Lewis                                       tlewis at ...120...

  God grant me the courage not to give up what I think is right, even
  though I think it is hopeless.          - Admiral Chester W. Nimitz

More information about the Snort-devel mailing list