Re: Hogwash vs. Snort-inline

[Ralf Spenneberg <lists () spenneberg org>]

Am Die, 2003-08-19 um 16.22 schrieb Matt Kettler:
> At 03:28 PM 8/19/2003 +0530, Ravi wrote:
> > Hi,
> > When coming to free IPS softwares, I heard more of snort_inline and 
> > HOgwash,but I tend to  snort_inline.
> > I have downloaded hogwash too and gone through the source, It seems to be 
> > using similar scan engine what snort is using
> > Correct me if I am wrong!!
>
> Hogwash's scan engine isn't just similar to snort.. it is snort. Hence the 
> name hogwash (a hog is a kind of pig, like the snort logo)
Hogwash used the snort engine a few years ago. Today hogwash uses a new
engine called H2. They want to build a compatibility layer which will
support snort rules, but haven't so far. So the rules use a different
Syntax.
Looking at the CVS there still is active development although the
mailing list is rather silent.

At the moment, I would prefer Snort-Inline.

Cheers,

Ralf
-- 
Ralf Spenneberg
RHCE, RHCX

Book: Intrusion Detection für Linux Server   http://www.spenneberg.com
IPsec-Howto                                  http://www.ipsec-howto.org
Honeynet Project Mirror:                     http://honeynet.spenneberg.org


-------------------------------------------------------
This SF.net email is sponsored by Dice.com.
Did you know that Dice has over 25,000 tech jobs available today? From
careers in IT to Engineering to Tech Sales, Dice has tech jobs from the
best hiring companies. http://www.dice.com/index.epl?rel_code4
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users