DoD plugin

["Tech-X" <domnick2 () hotmail com>]

If my guess is correct, this is going to be similar to SHADOW.  Shadow is an
IDS that was developed by Dahlgren Naval Surface Warfare Center and has been
used on military installations all over the globe.  This has become a bit
dated, and I think they are tying to implement something very similar using
SNORT instead of TCPDUMP.  Only time will tell exactly, but according to
everything recently written by Stephen Northcutt of SANS, Snort is the way
to go.  I also want to add that SHADOW was and still is a very good IDS
program, but some things just need to be updated ;)

I'll keep everyone posted as I learn more.


> From: "Clifford, Shawn A" <shawn.a.clifford () lmco com>
> Subject: [Snort-users] DoD plugin?
>
>
> This was in the lastest SANS training email.  Does anyone know more about
> this plugin, whether it will become public, etc?  Is there already
something
> similar available?
>
> -- Shawn
>
> --------------------------------------
> In the last SANS and GIAC update we talked about fighting back.  Thank
> you for all the responses, it turns out this is a hot theme.  You can
> see it in action on web pages like
> http://www.dshield.org/fightback.html
> http://www.mynetwatchman.com and www.incidents.org.
> The only thing missing is you if you aren't a contributor.  By the way,
> we are having trouble getting to word to Asia Pacific region ISPs. If
> you are in the Asia Pacific region and you are willing to help, would
> you please send the:
> - Name of your ISP
> - Their IP address range
> - Contact point for abuse or incidents to info () dshield org
>
> ****************************************
> Information Security Heroes
>
> All of these "fight back" programs involve making sense of large volumes
> of data.  To do that we need techniques that allow for massive data
> reduction.  Lt. Stephen D. Donald USN, and Captain Robert V.  McMillen
> USMC, from the Naval Postgraduate School.  worked for months, 7 days a
> week, taking as little time for sleep as possible, building a new
> intrusion detection capability based on a Snort plugin. The tool, while
> still under development, provides a realtime, intuitive graphics display
> and is being used by analysts on operational DoD networks as one more
> capability to help defend networks and identify cyber- attacks for which
> there is no known signature.  This is a DoD project and I don't know if
> it will ever be available for the general population, but this is
> exactly the sort of progress that we, as a community, need to make.
> --------------------------------------
>
> > From: "shawn . moyer" <shawn () net-connect net>
> Cc: "snort-users (E-mail)" <snort-users () lists sourceforge net>
> Subject: Re: [Snort-users] DoD plugin?
>
>
> From the article:
>
> > This is a DoD project and I don't know if
> > it will ever be available for the general population, but this is
> > exactly the sort of progress that we, as a community, need to make.
>
> ifdef ZEALOT
>
> Actually, I'd say if it isn't shared, it's exactly the kind of progress
> we *don't* need to make.
>
> endif
>
>
>
>
> --shawn
>
> --
>
> s h a w n   m o y e r
> shawn () net-connect net


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users