RE: Please help with IDXP...

Hi,

Some quick words..

Neither do I work for CodeFactory. I did however work for the company that
did start off the libidxp project (by paying CodeFactory ;). That company
has had economical problems and with those the initial funding plan behind
the fast development of libidxp was abandoned.

Some of the problems you've noticed (such as problems with sending more then
one message) where due to code problems (bugs) in beepcore-c (the beepcore
implementation that libidxp was profiled under). Those problems where, in
part, the reasons behind that CodeFactory made their own beepcore
implementation (the RoadRunner implementation).

I cannot really say, but.. I feel it's rather clear that more or less no new
work will be done, by CodeFactory anyways, on the libidxp implementation for
beepcore-c. The main pointer to that fact is that all the libidxp code was
"ported" (libidxp was initially designed to make this easy, so the changes
are not that big) to the RoadRunner implementation instead (and that port is
included as a beep profile in the RoadRunner project code).

I would suggest that you work with the RoadRunner code for all work with
IDXP, in favor of the "old" libidxp.

--
Aigars Grins

-----Original Message-----
From: [email protected]
[mailto:[email protected]]On Behalf Of Ryan Ripken
Sent: Tuesday, July 02, 2002 12:20
To: Joe McAlerney
Cc: Joseph M Kuitche; [email protected]; [email protected];
[email protected]
Subject: Re: [idxp] Please help with IDXP...


Joseph,

Let me preface this by saying that I don't work for Codefactory and I
can't speak for them.

If you need something stable I suggest you use the Roadrunner beep and
idxp implementations.  I have been told they are more reliable and will
be better supported (than libidxp).  I could be wrong but I think that
development of libidxp has stopped and that codefactory's efforts are
now focused on the Roadrunner implementations.

Although I've started working on something else for the moment, I was
working on adding idxp support to the snort plugin, I haven't had a
chance to play with the Roadrunner implementations yet so I can't help
you there.

If you are determined to use libidxp I may be able to help a little.

I hit a couple of snags when trying to use libidxp to send the messages.
 If you are just looking for a proof of concept for your paper/project I
may be able to help you get libidxp and the plugin to that point.  The
first thing I would suggest you look at are the samples idxp_client and
idxp_server.  These two samples work with each other, the client creates
and sends messages and the server consumes them.  Enable some of the
debugging options so that you can see the messages as they are sent and
received.

I suggest you play with the client and server applications and little
and see if they will work for you.  For me the server would crash after
receiving one message (but it did make it across).  I did a little
fiddling in libidmef code and libidxp code and now I can send any number
of messages but either the client or the server crashes when I attempt
to close the session.  I believe the problem is timing related.  I am at
a loss as to how to fix this last problem and when I get back to working
on using idxp I will probably look into using the Roadrunner
implementations rather than spending more time hunting for the bug.

I found that it was impossible to debug the applications in gdb; they
behaved differently for some reason in the debugger (I wish I knew why)
and the server wouldn't respond to attempts to open a new
session/connection.  I had to resort to printf fflush type statements
for debugging.

Ryan Ripken

Joe McAlerney wrote:

> Joseph,
>
> The current Snort IDMEF plugin does not support transport over IDXP.
> A new version of the plugin is being developed to include this, as
> well as conform to the latest version of the IDMEF spec.  There have
> been some snags in trying to implement IDXP.  Ryan Ripkin would be
> able to explain this further, as he is heading those efforts.
>
> -Joe M.
>
> --
> Joe McAlerney
> Silicon Defense: IDS Solutions
>
> On Monday, July 1, 2002, at 12:29 AM, Joseph M Kuitche wrote:
>
>> Dear Sirs,
>> I am trying to get into the IDS field. As part of my Masters project,
>> I want
>> to be able to convert the output from an IDS into the IDMEF format,
>> then send
>> it to another IDS via IDXP. I intend to use the Snort plugin, but I
>> am stuck
>> on the transport protocol. How can I create an IDXP interface to
>> Snort for
>> that purpose?
>> I would greatly appreciate your help of any kinds, as I am running
>> out of
>> time. Both my advisor and I are just trying to explore the field.
>> Thanks for your time.
>>
>> Joseph M Kuitche
>> Arizona State University
>> Graduate Student in Computer Eng Tech
>> Mesa, AZ 85212
>> Tel: (H) 480-884-1084 (W) 480-727-1220
>>
>> _______________________________________________
>> Idxp mailing list
>> [email protected]
>> http://lists.codefactory.se/mailman/listinfo/idxp
>>
>>
>
>
>




_______________________________________________
Idxp mailing list
[email protected]
http://lists.codefactory.se/mailman/listinfo/idxp