Inliniac » william metcalf http://www.inliniac.net/blog Everything inline. Thu, 29 Jul 2010 19:38:06 +0000 en hourly 1 http://wordpress.org/?v=3.0.1 OISF engine development update http://www.inliniac.net/blog/2009/08/16/oisf-engine-development-update.html http://www.inliniac.net/blog/2009/08/16/oisf-engine-development-update.html#comments Sun, 16 Aug 2009 14:17:32 +0000 Victor Julien http://www.inliniac.net/blog/?p=282 The last month has been crazy busy. Development of the engine is progressing nicely. My own role has been assigning tasks to our coders, guiding them, reviewing their work, integrating it and of course write code. We currently have nine people coding, not all full time though, and are still looking for more coders.

Progress has been made on a number of things: we have many more decoders, threading updates, a stats subsystem, stream tracking and reassembly, a L7 protocol parser framework and many more unittests. We’re working on OpenCL hardware accelaration, although we’re running into driver issues, so that may take some time before it’s usable.

On the QA side Will Metcalf is busy setting up an automated test rig, doing daily tests runs of our unittests on various platforms and with different compiler settings and such. When that is done pcap based tests and live traffic testing is next.

We have set up a number of “working group” mailinglists that discuss different subjects such as a configuration language and a rule language. Most are still ongoing, however the configuration language discussion seems to have come to a conclusion.

For the configuration language the discussion has settled on using YAML, a structured but still nicely editable format. It has many language bindings, so I hope management tools will be built for it later.

Other discussions, such as about the ip reputation, are still ongoing. You are very welcome to share your ideas with the group.

Like stated above, we’re still looking for coders. If you are a C coder and you’re interested in working with and for us, send us your resume!

]]> http://www.inliniac.net/blog/2009/08/16/oisf-engine-development-update.html/feed 0 Friendly pcap parsing http://www.inliniac.net/blog/2007/10/09/friendly-pcap-parsing.html http://www.inliniac.net/blog/2007/10/09/friendly-pcap-parsing.html#comments Mon, 08 Oct 2007 22:47:28 +0000 Victor Julien http://www.inliniac.net/blog/2007/10/09/friendly-pcap-parsing.html Over at his weblog node5, William Metcalf has written about a nice script he created for automagically extracting full content data for certain ip’s and ip ranges from large amounts of pcap data. It will also create some nice output for the data. Check out his post at node5 and the script here at bleedingthreats. Great to see you blogging Will! :)

]]> http://www.inliniac.net/blog/2007/10/09/friendly-pcap-parsing.html/feed 0 Snort_inline 2.6.1.5 released http://www.inliniac.net/blog/2007/06/08/snort_inline-2615-released.html http://www.inliniac.net/blog/2007/06/08/snort_inline-2615-released.html#comments Fri, 08 Jun 2007 12:55:29 +0000 Victor Julien http://www.inliniac.net/blog/?p=84 Finally, after many months of development and testing, Snort_inline 2.6.1.5 has been released. It’s the first stable release in almost a year and also the first stable release based on Snort 2.6. William sent the announcement:

snort_inline-2.6.1.5 released

List,

I know it has been a long time since we have had a non-beta release,
but what can I say? Victor and I have both been busy in our personal
and professional lives. If you have been running the version of code
in SVN, there are no major updates with this release other than a
memleak fix for stream4inline. I don't think this gets said often
enough, so I would like to thank Sourcefire for all the hard work they
put into snort and the snort rule sets for which I and the rest of the
community greatly benefit.

Regards,

Will

snort_inline-2.6.1.5
http://snort-inline.sourceforge.net/download.html

Differences between snort in inline mode and snort_inline
http://www.inliniac.net/blog/?p=74

Go and get it! :)

]]> http://www.inliniac.net/blog/2007/06/08/snort_inline-2615-released.html/feed 0