Re: a cutting-edge open-source network security project

On Sun, 2010-05-02 at 15:48 -0700, [email protected]
wrote:
> [...] Another idea is to "federate" against attacks, so that when your IDS
> (say, snort) detects an attack from an external entity, you block that
> entity at multiple locations (each of which run DFD, but which may run
> entirely different OSes and firewalls).  This hasn't been implemented
> but could prove itself rapidly useful (if engineered carefully).

When you say "this hasn't been implemented", are you referring to DFD?
I'm just asking because this approach has been around for a while.
Snortsam is now nearly a decade old and uses the approach of you call
"federated" defense, which I call "distributed blocking fabric".
(Snortsam receives block requests from one or more Snort instances and
blocks on one of more firewalls, or forwards the request to other
Snortsam instances). And I can attest that this approach works extremely
well (detect once, protect many).

So well so, that I stopped development on Snortsam for two reasons. 1)
Snortsam as it stands just works :)  and 2) we're enumerating so many
hostile IP's (even if only blocked for periods of time) that traditional
firewalls can no longer handle the load. Which led me to the development
of a new firewall module that, coupled with a database driven management
framework, can now handle transient shunning of millions of IP
addresses. I almost completed my migration from Snortsam to the new
framework.

Anyway, it looks like your DFD has a couple interesting features (for
example, the dynamic NAT stuff).

BTW: I'm starting a block-peering project for the exchange of hostile IP
block information. If you are interested in exchanging hostile IP
information, contact me off-list.

Cheers,
Frank

_______________________________________________
firewall-wizards mailing list
[email protected]
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.14 (FreeBSD)

iQIVAwUAS+JICzHAOJeJnj8BAQJjLxAAgRqw4mwDsh3iuUdJqHfOUcxBYT46AVV2
0Q2HX0UnRVNnlRuWhg7FZYxzeSSCZbxpqBoUhyS5dr79yfdqrvn1NXHGRRey7uaS
EPsHAGDRXm+Ch8csfF71/sDYnaw18UetNa3CUk6avmyiDzeYhDS217Cuniivn1vz
OVh+jKPF1Q/20ZT9lZGwq8qT7hHKdk44zJNjcZlmWwrGOulRXndWlBS1s6TV3Mfs
xJeGniF6sH5j+dUIL4EyUI48Lr2NLkIj0zLAC4VbQvSBoNxbFicsZ829IoeqdHzm
SJF55I/+O9oItOhiZMP5g3wrivA1p5xMRMo42qlScsiPz55BLe79+4ROJlDrJxlq
eVXuGufPP3dIJg8BnbemXYiO4vCQwAy7cpX645Ee6GHtZ4ujm44ZqyLDj6+HW9yu
3TTxlpCWBP3EjGZ826C7faTfLtRMFFRYfhirPS96ZVFuCxrHpCmPFL5V2spjnTWP
i4InVlAlWozFPQkoC0detfDJpWg6ljlxvgqgRyK3lidMjRPzxhbr8qsN4GBvgxU3
soEeP7DwkA+dszgPgput+qfwwczg1kTMiok262HgnW/5BY6ik8HF0Q+ZgmlbmGN/
uKztfHm1ZGvA4tcw+uEYjwIxPN8oAn00rnTynEClf4lGOnX4swbbdxyx4dYrcto/
P0o9WTnDFcs=
=efYB
-----END PGP SIGNATURE-----