High Efficiency IPS

Hi -

I'm looking for either software (or a dirty hack) that will allow me to drop packets that meet very specific rules.

I know everyone is thinking "Snort" + snort-inline or something similar, but extreme simplicity and speed is what I need for my network.

I feel snort may be overkill when I expect to be using <10 signatures. It is research grade bandwidth on a critical link, so I assume a snort cluster would likely bottleneck my environment, and hopefully simpler something could operate without notice.

Kind of an odd question... I know...

Quote:

---

Originally Posted by d34dl0k1

Hi -

I'm looking for either software (or a dirty hack) that will allow me to drop packets that meet very specific rules.

---

What kind of specific rules?

Quote:

---

It is research grade bandwidth on a critical link, so I assume a snort cluster would likely bottleneck my environment, and hopefully simpler something could operate without notice.

---

What kind of bandwidth are we talking about?

He is trying to make the client drop packets so they have to be retransmitted and they get ddosed! Dont tell him how to do it!

Maybe you are looking for a "packet filtering" program? A rule based firewall would help you out there.

for instance when remote code execution appears on a critical webserver, the IPS would be loaded with a rule to detect and drop the packet. when a patch is ready, the signature can be disabled. similar to any other server vulnerability that I would need to temporarily mitigate while patches are prepared.

AFAIK IPTables doesn't inspect the data in packets, only headers ...and now as I google it seems it has string matching

http://www.securityfocus.com/infocus/1531

wonderful. anyone use this feature?

Wouldnt "Stateful Packet Inspection" work?

This is about packet data, not transport headers.

I have an example -

All I want to do right now is search for

Code:

---

exec('

---

in the data of packets towards 80, and then run a perl script on it when true. I feel like don't need all kinds of crap bloated software when I can just somehow pipe the damn packets through some simple code

Snort... But you don't seem to want that...

Yeah... just seems like overkill for my purpose.

Have you looked at the extent to which you can disable unwanted features and tailor the detection rules to better suit your particular requirements?

I was always given to understand that it was quite configurable?

possibly ipkungfu? http://www.linuxkungfu.org/

With snort just remove all the standard rules and make a few of your own.

Quote:

---

Originally Posted by d34dl0k1

Yeah... just seems like overkill for my purpose.

---

Quote:

---

Originally Posted by SirDice

With snort just remove all the standard rules and make a few of your own.

---

Exactly. Just becuase it has hundreds more features than you need, don't rule it out. Only use the features you need and disable the rest. At least with snort there is going to be plenty of signatures that you can use for templates and the documentation is pretty good. Try writing IDS/IPS rules for other platforms. Many of them are very confusing...

BTW: Didn't see it listed. You said it was a high speed critical link, but you didn't define high speed.