Re: [Netadm-devel] hi il-eok hwang [everyone readme please]

SourceForge Headquarters 1320 Columbia Street Suite 310 San Diego, CA 92101 +1 (858) 422-6466

hi jeho-park

Did you have a lunch?? yesterday i did work for LAC all the night through.
so i am fatigue.

anyway..

jeho-park wrote:
       i can't sure what is the best solution, but i think it may be
dependent on network
       environment (gateway.. or sensor mode)  and system performances.  i
suggest that before starting
       design, we should talk about this.because it is not easy to remake
the frame,

sure, i think so. thanks for your concern.

maybe you have some misunderstanding for my mail. currenty i use zebra for
dynamic routing in my company's project.  as i think, gwc's cli is better
than zebra's cli. ^.^*~~

once more, thanks for your concern.

haver a nice day~~

2006/3/9, jeho-park <lin...@gm...>:
>
> hi il-eok
>
> can you please cc net...@li... address whenever you send
> email ^-^
>
> il-eok hwang wrote:
>
> Hi, jeho park and everyone~~
>
> Sorry, My work's results are not mine but my company. and I did leave my
> company one month ago.
> So i will give you any doc currently.
>
>
> yes i understand, and i hope you to share some doc without breaking the
> license with your past company.
>
>  As you know, Snort Inline use netfilter target called IP_QUEUE.
> and IP_QUEUE used netlink. i think these are not good solution.
> How about you??
>
>
> last year, i heard that snort supports netfilter target. but i didn't
> check it or know more than that.
> from reading your letter, i realized the target is IP_QUEUE.
>
> i can't sure what is the best solution, but i think it may be dependent o=
n
> network environment(gateway.. or sensor mode)  and system performances.  =
i
> suggest that before starting design, we should talk about this.
> because it is not easy to remake the frame,
>
> you said to me as below.
>     i can imagine that there might be so many changes was needed to port
> snort to kernel layer.
>     but i wonder all of snort code was really needed to port to the kerne=
l
> layer?
>     if so, what is the main motive of this porting ?
>     is it for more better performance of checking network packet ? ( i
> assume you might throw away
>     current libpcap(premiscuous) concerned code of snort then you must
> have replaced that with
>     netfilter hook )
>
> it's a good solution.  but as i think, mbuf is better than libpcap.  some
> IDS were developed with
> zero copy tech in Linux.
>
> TODO.
>   - intrusion detection point in kernel : preprocessor & pattern matching
> engine
>   - packet drop by rule
>   - use conf file and rule file in user land.
>   - ....
>
> recently, i works for developing L2TP - LAC, LNS. there are some bugs in
> rp-l2tp & zebra,
> so i will catch the bugs.  after fixing-maybe 4days, i will check the
> current our project's source
> codes.
>
>
>
> i recommand this document.
> http://netadm.sourceforge.net/devel_netadm_ko.txt  especially chapter 3,4=
,
> 5
>
> i think you dont have to understand all of our code but the interface
> which let you make your cli command
>
> i know zebra interface is not bad.. and used globaly..  but our cli
> interface more simple, and easy to build
>
> and make your cli command exported GUI interface.  check
> "include/confproc.h" and gwclib/conftab.c
>
> gwclib/confproc.c
>
> bye ~
>
> see you later~~
>
> 2006/3/8, jeho-park <lin...@gm...>:
> >
> > hi il-eok
> >
> >
> > il-eok hwang wrote:
> >
> > Hi, jeho park and everyone~~
> >
> > first, sorry for my poor english.
> >
> > as i think, i quite agree with you and i hope to help our project about
> > the field of IPS( DPI ).
> > if my opinion will be established, i wll make a document about DPI.
> >
> > there are some problems in porting SNORT to kernel. see below.
> >     - memory
> >     - rule
> >     - log
> >     - etc
> >
> >
> > that's great !  if you make it with korean, i will help to translate
> > this document into english.
> >
> > through reading your letter,  i become  excited ^--^ and have so many
> > question.
> >
> > i can imagine that there might be so many changes was needed to port
> > snort to kernel layer.
> > but i wonder all of snort code was really needed to port to the kernel
> > layer?
> > if so, what is the main motive of this porting ?
> > is it for more better performance of checking network packet ? ( i
> > assume you might throw away
> > current libpcap(premiscuous) concerned code of snort then you must have
> > replaced that with netfilter hook )
> >
> > i think  as you replaced libpcap with netfilter hook, you could check
> > all network packet without packet loss.
> > but i wonder as a result of that, how did you lost system performance o=
r
> > network throughput
> > i want to know about this point because you already have done this test=
.
> >
> >
> > 6 months ago, i did port to kernel with netfilter.
> > recently, i make a new kernel hook, so i will port SNORT with a my
> > hook instead of netfilter.
> >
> > have a nice day  ^.^*~~
> >
> >
> >
> > from my knowledge, current netfilter hook is ranged from ethernet layer
> > to IP layer..
> > did you mean your hook covers TCP. UDP layer ?
> > i will wait your reply.
> >
> > if it is possible, please let us show the framework as a form of figure
> > which you had done 6 month ago,
> > and current design.  they must be very interesting. and i am sure
> > everyone want to know about that ^---^
> >
> >
> > p.s:
> > since i start this project,
> > i have thought that current pf.c will receive the last alarm from snort
> > or other IDS sensor,
> > so pf , as a result of receving alarm, will drop a specifed source host
> > or  control traffic of suspicious host.
> > but during reading your letter, i think you already have done it. isn't
> > it ?
> > if so, i don't mind throwing away my design. then i can more concentrat=
e
> > my energy only to "flow control" ^--^
> >
> > regards
> > jeh park
> >
> >
> >
> > 2006/3/8, jeho-park <lin...@gm...>:
> > >
> > >
> > > hi il-eok
> > > glad to meet you through this mailling list.
> > >
> > > i read your mail, so i thought you have good career about security
> > > i expect you to help our project about the field of QoS or IPS.
> > >
> > > most of all, i wonder how did you ported snort to the network stack o=
f
> > > linux.
> > >
> > > todays, george and kwan-kyung is also researching about that. so i
> > > hope
> > > you to share your knowledge with them.
> > >
> > > regards
> > > jeho park
> > >
> > >
> > >
> > >
> > >
> > > -------------------------------------------------------
> > > This SF.Net email is sponsored by xPML, a groundbreaking scripting
> > > language
> > > that extends applications into web and mobile media. Attend the live
> > > webcast
> > > and join the prime developer group breaking into this new coding
> > > territory!
> > >
> > > http://sel.as-us.falkag.net/sel?cmd=3Dlnk&kid=3D110944&bid=3D241720&d=
at=3D121642
> > > _______________________________________________
> > > Netadm-devel mailing list
> > > Net...@li...
> > > https://lists.sourceforge.net/lists/listinfo/netadm-devel
> > >
> >
> >
> >
>
>