/etc/hlbr/hlbr.conf
default configuration file.
hlbr8
Hogwash light br
Usage
hlbr -c
config-file
-r
rules-file
[-l
logs-directory]
[-tndv]
Overview
HLBR is an IPS (Intrusion Prevention System) that can filter packets directly in the layer 2 of the OSI model (so the machine doesn't need even an IP address). Detection of malicious/anomalous traffic is done by rules based in signatures, and the user can add more rules. It is an efficient and versatile IPS, and it can even be used as bridge to honeypots and honeynets. Since it doesn't make use of the operating system's TCP/IP stack, it can be "invisible" to network access and attackers.
HLBR is based in Jason Larsen's Hogwash, available at http://hogwash.sf.net
Options
The options described here must be specified at the command line:
-
-t -
Parse rules and exit.
-
-n -
Process n packets and exit.
-
-d -
Enter Daemon Mode (Background Execution).
-
-v -
Print version and exit.
Files
-
/etc/hlbr/hlbr.rules -
default rules file.
-
/etc/hlbr/empty.rules -
empty rules file (for testing purposes).
Incompatibilities
All tests were done under Debian GNU/Linux (Sarge and Etch Stable + Lenny Testing) and Slackware (11 and 12). It works nicely. We recommend DEBIAN and Slackware!
HLBR rules
To make or adjust HLBR rules, please see the README file (in Debian it can be found into /usr/share/doc/hlbr/ ).
Team
Please see: http://hlbr.sourceforge.net/corner.html