Re: Snort-Inline and worm containment

From: Shaiful <shaifuljahari(at)yahoo.com>
Date: Wed Jan 29 2003 - 19:29:46 EST

Hi,

I've never tried snort-inline but I believed the concept is similar to hogwash.

If you want information about similar arrangement, just search for hogwash implementation. Last time I checked there are quite a few.

For the last Code Red worm outbreak, I've used hogwash and block Code Red. IMHO, Code Red is worst since it uses port 80 which normally open at the firewall.

Running hogwash make me think why on earth the idea of stopping application attack at layer 2 or 3 is not popular before. Actually I've been waiting for hogwash like program one year before it is released and mostly due to my poor coding skill. The idea is quite old if you bother to search snort mailing list. But looking at hogwash code, then I realised it is not really rocket science ;-)

Regards,
Shaiful

• Tom McLaughlin <tmclaugh@sdf.lonestar.org> wrote:
  > Hi everyone,
  

  ---

Do you Yahoo!?
Yahoo! Mail Plus - Powerful. Affordable. Sign up now. http://mailplus.yahoo.com Received on Fri Jan 31 11:40:58 2003