Re: Download packet

> You already have packet payload in Prewikka,

In what format it is stored? I've looked at database and it is BLOB
type (obviously) but for packets - how are they stored in IDMEF spec?
Seriously I am ignorant. Please explain. ;)

> so I don't expect that this  would be hard to implement.  Still, the question
> would be, "who is gonna write the code?"  It's not a widely-requested
> feature, so it probably wouldn't be on the hot list.

Heh the ability to analyze a packet data with a tool that can
interpret it in various formats/protocols etc. like  Wireshark is a
feature that IMHO is essential.

IMHO it would be extremely hard to implement what Wireshark does in
Prewikka so it makes no sense to implement it there - Wireshark does
it extremely well so just pass the file from Prewikka to client
application and you are done with this feature.

I compare Prelude to Mc Afee IPS systems that are quite commercial
standards these days and these systems do that. So it IMHO is an
feature to copy.

>  Your best bet is to open a ticket on Trac asking for the feature to be
>  added.

I'll try. :)

>  Well, actually, your *best* bet is to write the code yourself, and
>  submit it for inclusion.  No one ever does that, though.  :)

The problem is I probably can't do it right now. It would require me
to dive into Prelude code and so on - I simply don't have time for it.

Don't get me wrong guys - really Prelude has much potential right now.
It is well designed and shows promise. But for me it has a strange
status - when I asked about database performance (poor) I was offered
an solution priced 3000EUR which is quite expensive.

So the impression I've got was - "yes it has poor DB performance -
wanna better - pay us". It's OK but how exactly should this encourage
me to participate as in open source project?

Right now I work in quite big enterprise and I am implementing Snort
probes in places where we cannot implement other (commercial) probes
since we don't have budget for that. Paying 3000EUR would be
equivalent to just getting the probes we need in system we already
have.

Please don't get is as trolling/flame etc. I've just stated my (as an
user of your software) ideas about it. That's it. Think about it.
_______________________________________________
Prelude-user site list
[email protected]
http://www.prelude-ids.org/mailman/listinfo/prelude-user