Re: Hogwash vs. Snort-inline

[Matt Kettler <mkettler () evi-inc com>]

At 03:28 PM 8/19/2003 +0530, Ravi wrote:
> Hi,
> When coming to free IPS softwares, I heard more of snort_inline and 
> HOgwash,but I tend to  snort_inline.
> I have downloaded hogwash too and gone through the source, It seems to be 
> using similar scan engine what snort is using
> Correct me if I am wrong!!

Hogwash's scan engine isn't just similar to snort.. it is snort. Hence the 
name hogwash (a hog is a kind of pig, like the snort logo)


> But I still want to know if any body have tested throughput for 
> snort_inline and hogwash?
> As both IPS send packets to user space,I dont see a reall difference in 
> throughput.
> The important thing that matters is the ongoing 
> development.Snort_inline  is very much active than hogwash.

Agreed, the state of documentation of hogwash is pretty limited.

The two tools seem very similar from a casual glance and I can't tell the 
difference between them at the moment. 



-------------------------------------------------------
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users