This is a proof of concept. A tool developed at Universidad Tecnologica Nacional (Argentina).
It detects attacks and it responses with isolation attacks. It's supposed to be on the same network of the protected hosts. It must be capable to see all the traffic. It's a basic IPS with a self defense module. So it can prevents future attacks from the same hosts, which is identified by its mac address.
This project implements IPSec as NDIS Intermediate filter driver in Windows 2000. This IPSec driver appears as Virtual NIC to protocol drivers like TCP/IP driver. The network applications need not be aware of the existance of this IPSec driver