Snort 3.0 - Network intrusion prevention and detection system (IDS/IPS)

Snort is the most powerful IPS in the world, setting the standard for intrusion detection. So when we started thinking about what the next generation of IPS looked like we started from scratch.

Features

• Support multiple packet processing threads
• Shared configuration and attribute table
• Use a simple, scriptable configuration
• Make key components pluggable
• Autodetect services for portless configuration
• Support sticky buffers in rules
• Autogenerate reference documentation
• Provide better cross platform support

Download Snort 3

Read More

[IDSwakeup] Collection of Tools to test network intrusion detection systems

IDSwakeup is a collection of tools that allows to test network intrusion detection systems.
The main goal of IDSwakeup is to generate false attack that mimic well known ones, in order to see if NIDS detects them and generates false positives.

This release of IDSwakeup includes:

• IDSwakeup The main shell script that permits to launch hping2 or iwu. The user just has to choose which attack or set of attacks he or she want to mimic. The user can also fix the TTL to produce short TTL and impact only NIDS and not the servers.
  Usage: ./IDSwakeup <src addr> <dst addr> [nb] [ttl]
  IDSwakeup requires hping2.
  
• iwu Sends a buffer as a datagram. It allows to change the source address, the destination address, the TTL (in order to produce short TTL). It also takes as parameter the number of times the user wants to send the same datagram.
  Usage: ./iwu <srcIP> <dstIP> <nb> <ttl> <ip-datagram>
  Example: ./iwu 10.0.0.1 20.0.0.2 200 4 \
          "4500 0018 00f2 0003 4011 73db 0101 0101 0202 0202 e63e 4494"
  iwu requires libnet 1.x.

IDSwakeup suite is written by Stéphane Aubert, it is available in a beta version and published under a BSD-style license.

Download IDSwakeup

Read More