Can Zeek be installed as in-line IPS?

Dario Mohaddes <[email protected]>
Newsgroups gmane.comp.security.detection.bro
Message-ID <CAHHGpOsiWoAordNtKyJSpzHak8JDmL+O2azOsbQ0dyKb_CppHw@mail.gmail.com>
I'm starting a comparison paper about inline Network IPS. I was looking for
an opensource anomaly-based detection engine with IPS capabilities. The
easiest choice seemed Zeek but from the website user-manual it doesn't look
like it actually supports packets dropping, instead can only work as IDS.
Digging a bit online I found a lot of confusion and contradictions with
people asserting either that is possible or not but none giving a practical
example. I have scraped a multitude of academic and research papers but
they haven’t help... I was wondering if anyone can tell me if is feasible
before wasting hours trying to do something that is not. Any help or
insight is much appreciated. Thank you.

_______________________________________________
Zeek mailing list
[email protected]
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.