Intrusion Detection Systems: Re: kernel implementations

[dugsong () monkey org (Dug Song)]

Archive: http://msgs.securepoint.com/ids
FAQ: http://www.ticm.com/kb/faq/idsfaq.html
IDS: http://www-rnks.informatik.tu-cottbus.de/~sobirey/ids.html
UNSUBSCRIBE: email "unsubscribe ids" to majordomo () uow edu au
On Fri, 21 Jul 2000, Robert Graham wrote:

> For network-IDS, it doesn't really make sense to have a "kernel"
> implementation.
who said anything about kernel mode network IDS?

i think john is just trying to expose more of the bare metal to the
application, exokernel style, with zero-copy packet sniffing.

NFR did something very similar, with excellent results.

-d.

http://www.monkey.org/~dugsong/