First step towards an IDS

msantos / epcap

Erlang packet capture interface using pcap

http://listincomprehension.com/2009/12/erlang-packet-sniffer-using-ei-and.html

BSD 3-Clause "New" or "Revised" License

178 stars 56 forks source link

First step towards an IDS #10

Closed josemic closed 10 years ago

josemic commented 10 years ago

IDS rules are split into concatenated OTP application:
currently available OTP applications:
- epcap_app - provides packages (UDP, TCP, ..) from epcap_nif
- content_app - parses text content
- currently packages are piped as: epcap->content
- as soon as e.g. an http_app becomes available, data might be piped as following: epcap->http->content
rules can be activated and deactivated individually step by step upon demand without disruption
works with Erlang observer application, which is available from Release 16B. (observer:start())

ates commented 10 years ago

Very interesting changes, but I think it's not good idea to make an IDS from epcap. epcap it's just a small library to capture the traffic, it's used in various projects which not related to IDS things. I believe it would be better to make separate project implemented IDS and based on epcap.

msantos commented 10 years ago

@josemic replied to your email but I agree with @ates, this deserves to be broken out as a standalone application

josemic commented 10 years ago

I agree. It will become a different piece of software. Please leave this open, so this can be used for further discussion as I refactor the code.