Re: P0F in Snort?

Quoting Matt Jonkman 
<jonkman-WwB1pFISwSkm7effSn6vN9HuzzzSOjJt@xxxxxxxxxxxxxxxx>:

> You have it doing a db lookup to p0f? Or a preproc?


Right now the detection plugin pulls the lookup from a text file  
generate by p0f :(  .  I haven't yet decided on the "best" way to make  
the p0f data available to the ostype detection-plugin.

I like the bdb database idea because it is so quick and it's low  
overhead.  But I'm still open to suggestions on how best to get the  
lookup for [ ip_addr <-> p0f_fp ] .  The hold-up on this part is my  
own ignorance of the internal interfaces into p0f.

jp

-------------------------------------------------
Email solutions, MS Exchange alternatives and extrication,
security services, systems integration.
Contact:    services-MMNQ1ylbVXZN8Ch2cx6nig@xxxxxxxxxxxxxxxx