Re: Please help with IDXP...

Joseph,

Let me preface this by saying that I don't work for Codefactory and I 
can't speak for them.

If you need something stable I suggest you use the Roadrunner beep and 
idxp implementations.  I have been told they are more reliable and will 
be better supported (than libidxp).  I could be wrong but I think that 
development of libidxp has stopped and that codefactory's efforts are 
now focused on the Roadrunner implementations.  

Although I've started working on something else for the moment, I was 
working on adding idxp support to the snort plugin, I haven't had a 
chance to play with the Roadrunner implementations yet so I can't help 
you there.

If you are determined to use libidxp I may be able to help a little.

I hit a couple of snags when trying to use libidxp to send the messages. 
 If you are just looking for a proof of concept for your paper/project I 
may be able to help you get libidxp and the plugin to that point.  The 
first thing I would suggest you look at are the samples idxp_client and 
idxp_server.  These two samples work with each other, the client creates 
and sends messages and the server consumes them.  Enable some of the 
debugging options so that you can see the messages as they are sent and 
received.

I suggest you play with the client and server applications and little 
and see if they will work for you.  For me the server would crash after 
receiving one message (but it did make it across).  I did a little 
fiddling in libidmef code and libidxp code and now I can send any number 
of messages but either the client or the server crashes when I attempt 
to close the session.  I believe the problem is timing related.  I am at 
a loss as to how to fix this last problem and when I get back to working 
on using idxp I will probably look into using the Roadrunner 
implementations rather than spending more time hunting for the bug.

I found that it was impossible to debug the applications in gdb; they 
behaved differently for some reason in the debugger (I wish I knew why) 
and the server wouldn't respond to attempts to open a new 
session/connection.  I had to resort to printf fflush type statements 
for debugging.

Ryan Ripken

Joe McAlerney wrote:

> Joseph,
>
> The current Snort IDMEF plugin does not support transport over IDXP.  
> A new version of the plugin is being developed to include this, as 
> well as conform to the latest version of the IDMEF spec.  There have 
> been some snags in trying to implement IDXP.  Ryan Ripkin would be 
> able to explain this further, as he is heading those efforts.
>
> -Joe M.
>
> -- 
> Joe McAlerney
> Silicon Defense: IDS Solutions
>
> On Monday, July 1, 2002, at 12:29 AM, Joseph M Kuitche wrote:
>
>> Dear Sirs,
>> I am trying to get into the IDS field. As part of my Masters project, 
>> I want
>> to be able to convert the output from an IDS into the IDMEF format, 
>> then send
>> it to another IDS via IDXP. I intend to use the Snort plugin, but I 
>> am stuck
>> on the transport protocol. How can I create an IDXP interface to 
>> Snort for
>> that purpose?
>> I would greatly appreciate your help of any kinds, as I am running 
>> out of
>> time. Both my advisor and I are just trying to explore the field.
>> Thanks for your time.
>>
>> Joseph M Kuitche
>> Arizona State University
>> Graduate Student in Computer Eng Tech
>> Mesa, AZ 85212
>> Tel: (H) 480-884-1084 (W) 480-727-1220
>>
>> _______________________________________________
>> Idxp mailing list
>> [email protected]
>> http://lists.codefactory.se/mailman/listinfo/idxp
>>
>>
>
>
>