Pharos Network Intrusion Prevention System

[lattera]

Well, I can now say what my new project is...

It's an intrusion prevention system, called Pharos.

If a packet's payload matches a payload in a database, the packet is discarded.

Development information can be found on the Pharos forum of the NoSleep BBS (http://forums.nosleep.info/).

For those who wish to help, you need:

1. A spare FreeBSD box (preferably more than one, for testing purposes)
2. Good C skills
3. Time, and lots of it

Thanks,

lattera

[Stewsburntmonkey]

This is different from other IDSs how?  :)

[ToRmEnToR]

it has a seksy name

and also i think its about prevention, not detection... or does an IDS discard evil packets too?

[lattera]

An IDS detects packets, but not discards them.

An IPS is an IDS that discards packets...

[Stewsburntmonkey]

I have seen a lot of IDS that also suppress malicious packets (many are coupled with an anti-virus program), and then there are many full fledged IPSs out there.  I was just wondering why this would be better.  :)

(Edited by Stewsburntmonkey at 10:40 am on Jan. 14, 2004)

[lattera]

The problem with most IDSs, is that you can't run any actual daemons/servers with them. You can't have both the IDS listening on port 80 and an HTTP server listening on port 80 (well, you probably can, but that'd require major kernel code changed).

My IPS is better, because:

1. It listens on the TCP/IP stack on different interfaces (via ipfw divert).
2. It will have heuristics analysis (not right now, but later on)
3. It will eventually have 0% false positives
4. It's main development system is FreeBSD, so that already makes it l33t3r than all

[Stewsburntmonkey]

Heh, 0% false positives, silly man.  

I am just asking how this is different from all the other IPSs out there, some with millions of dollars in devopment budgets.  It is also perfectly easy to run an HTTP server with a IDS/IPS going.  :)

[lattera]

well, ya, if you have the HTTP server listening on a different port...

The thing with other IPSs, is that none of them are free (well, one, but it's disqualified because it requires Snort).

[Stewsburntmonkey]

Snort is also free. . .  Well anyway good luck, just wouldn't want you to be waisting your time.  :)

[lattera]

Snort is an IDS, not an IPS...

[Stewsburntmonkey]

Quote: from lattera on 10:57 am on Jan. 14, 2004[br]
The thing with other IPSs, is that none of them are free (well, one, but it's disqualified because it requires Snort).

You acted like requiring Snort was somehow and issue.  I have seen several good IPSs running off Snort.  An IPS needs a good IDS at its heart to work, so using Snort is a great way to go.  Snort is open source and freely avalible.  Plus it works well.  I just see no reason to reinvent the wheel.  :)

[lattera]

Also, that IPS that uses snort is for Linux (uses IPTables), so that's ruled it out as well

[Stewsburntmonkey]

I've seen atleast one for Windows, but I guess that doesn't help you does it.  (BSD loser ).  

(Edited by Stewsburntmonkey at 1:19 pm on Jan. 16, 2004)

[TimTim]

Quote: from Stewsburntmonkey on 7:19 pm on Jan. 16, 2004[br](BSD loser

What bsd sucks now? Bah i've downloaded a copy for use as a server in school, no way i'm downloading a copy of *nix, maybe in school though ¬_¬

[Stewsburntmonkey]

BSD is *nix . . .

Anyway, I'm just playing with lattera, see the " ".  BSD is a very good OS especially for servers and such.  :)