From owner-freebsd-questions  Fri Aug 17 22:18:27 2001
Delivered-To: freebsd-questions@freebsd.org
Received: from inconnu.isu.edu (inconnu.isu.edu [134.50.8.55])
	by hub.freebsd.org (Postfix) with ESMTP
	id DE71737B407; Fri, 17 Aug 2001 22:18:20 -0700 (PDT)
	(envelope-from galt@inconnu.isu.edu)
Received: from localhost (galt@localhost)
	by inconnu.isu.edu (8.11.2/8.11.2) with ESMTP id f7I5Hca05265;
	Fri, 17 Aug 2001 23:17:38 -0600
Date: Fri, 17 Aug 2001 23:17:36 -0600 (MDT)
From: John Galt <galt@inconnu.isu.edu>
To: Joe Clarke <marcus@marcuscom.com>
Cc: Dave <dave@reason.za.org>, <freebsd-security@FreeBSD.ORG>,
	<freebsd-questions@FreeBSD.ORG>,
	<hogwash-users@lists.sourceforge.net>
Subject: Re: IDS
In-Reply-To: <20010817153110.U59726-100000@shumai.marcuscom.com>
Message-ID: <Pine.LNX.4.33.0108172252040.6229-100000@inconnu.isu.edu>
Mail-Followup-To: galt@inconnu.isu.edu
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-freebsd-questions@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-questions.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-questions>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-questions>
X-Loop: FreeBSD.ORG


We DO have a -users list, and we ARE trying to go with the BSD setup, it's
just our main author is more comfortable with Linux.  However, I believe
that we should have a FreeBSD test box RSN (4.3R), as we have two people
working on getting one up: one'll be up within a week.  Pity :( I was
waiting until FreeBSD 4.4 came out to get the box in question up: looks
like a cvsup/make world...

On Fri, 17 Aug 2001, Joe Clarke wrote:

>You can certainly get hogwash to compile on FreeBSD.  I just did it.  Let
>me know if you have questions on the build.
>
>Joe Clarke
>
>On Fri, 17 Aug 2001, Dave wrote:
>
>> Hello,
>>     I have been using snort for some time now and I stumbled across a
>> program named Hogwash (http://hogwash.sourceforge.org) which uses the snort
>> base to detect possible intrusion, but then DROPS the packet if it matches a
>> ruleset. E.g. Code red can just be dropped instead of blocking port 80.
>>
>> This seems like a very good idea to me however hogwash is a linux program.
>> Can anyone perhaps recommend another program and/or method to do this.
>>
>> Thanks in advance,
>> --Dave.
>>
>>
>>
>>
>> To Unsubscribe: send mail to majordomo@FreeBSD.org
>> with "unsubscribe freebsd-questions" in the body of the message
>>
>>
>
>
>To Unsubscribe: send mail to majordomo@FreeBSD.org
>with "unsubscribe freebsd-questions" in the body of the message
>

-- 
The Internet must be a medium for it is neither Rare nor Well done!
<a href="mailto:galt@inconnu.isu.edu">John Galt </a>


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message