Hogwash Light BR
HLBR is an IPS (Intrusion Prevention System) that can filter packets directly in layer 2 of the OSI model (invisible to attackers). Detection of malicious/anomalous traffic is done by rules based on signatures. It is an efficient and versatile IPS, and can be used as a bridge to honeypots and honeynets. HLBR is a firewall element and can use regular expressions to detect malicious traffic. For example, a rule which might detect links to viruses in email messages would be 'tcp regex(href="[^\n]+\.scr")'.
| Licenses | GPL |
|---|---|
| Operating Systems | POSIX Linux |
| Implementation | C |
| Translations | English Portuguese |
Recent releases
- 28 Feb 2010 11:04
Release Notes: $remote_fs was added to the init script to make it compliant with LSB and Debian. This adjustment will prevent the init script from being run before /usr is mounted or after it is unmounted.
- 10 Feb 2010 15:26
Release Notes: The CODE_REVISION macro was added in hlbr.h. hlbr.c was updated to show it when PrintVersion() is called. A -t option was added in scripts/hlbr.rotate to create an empty events log file after the rotate. New rules were added. A bug was fixed in decoders/decode_ip_defrag.c, solving another race condition bug in IPDefrag. engine/cache.{c,h} was updated with features needed to solve IPDefrag's race condition bug. The manpage and READMEs were updated.
- 08 Dec 2009 21:19
Release Notes: This release solves a race condition bug in IPDefrag. There are other minor bugfixes.
- 18 Jul 2008 16:40
Release Notes: This release adds decoder-specific memory deallocation functions, adds install-daemon to Makefile.in, changes some rules, fixes JTree issues, and makes IPDefrag work.
- 18 Jun 2008 17:18
Release Notes: The URI test has been moved to the HTTP test (still testing). An HTTP method test has been added. An URI decoder has been added to the engine. Now decoders may have configuration options. New (and more efficient) HTTP header detection. test_ethernet_{src,dst}.c and README.{en,pt_BR} have been updated. The tcpdump header has been changed from /var/lib/hlbr to /usr/lib/hlbr. A description and force-reload option have been added to init.d to make it compliant with Debian and LSB. There are new rules.
Heartbeat
- Popularity Score
- 78.57
- Vitality Score
- 5.61
- Subscriptions
- 20
