From owner-freebsd-questions  Fri Aug 17 12: 0:13 2001
Delivered-To: freebsd-questions@freebsd.org
Received: from cerebellum.za.net (cerebellum.za.net [196.34.172.103])
	by hub.freebsd.org (Postfix) with ESMTP
	id 1DC4237B40F; Fri, 17 Aug 2001 12:00:02 -0700 (PDT)
	(envelope-from dave@reason.za.org)
Received: from mandy (nunetnt2.nutech.co.za [196.34.172.5])
	by cerebellum.za.net (8.11.3/8.11.3) with SMTP id f7HIsi264999;
	Fri, 17 Aug 2001 20:54:44 +0200 (SAST)
	(envelope-from dave@reason.za.org)
Message-ID: <001f01c1274e$cdc8b620$3400a8c0@mandy>
From: "Dave" <dave@reason.za.org>
To: <freebsd-security@FreeBSD.org>, <freebsd-questions@FreeBSD.org>
Subject: IDS
Date: Fri, 17 Aug 2001 20:59:54 +0200
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 5.50.4133.2400
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4133.2400
Sender: owner-freebsd-questions@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-questions.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-questions>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-questions>
X-Loop: FreeBSD.ORG

Hello,
    I have been using snort for some time now and I stumbled across a
program named Hogwash (http://hogwash.sourceforge.org) which uses the snort
base to detect possible intrusion, but then DROPS the packet if it matches a
ruleset. E.g. Code red can just be dropped instead of blocking port 80.

This seems like a very good idea to me however hogwash is a linux program.
Can anyone perhaps recommend another program and/or method to do this.

Thanks in advance,
--Dave.




To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message