[Oisf-users] New IDS tool, looking for beta testers

[Jack Radigan]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I've just published the first beta release of a plugin (dissector) that
gives you the ability to view Snort/Suricata alerts from within
Wireshark. A companion set of tools provide you with the ability to
create multiple "configuration instances" so that you can quickly switch
from one to another within Wireshark for comparing differences between
them for the same pcap file.

An overview of the tools and demo of the plugin can be viewed at:
https://vimeo.com/88460795

Everything is currently limited to Linux, but I am working on a
Windows version of Wireshark with the plugin, no timeframe on when it
will be ready for testing though.

The packages for this were developed and tested with Centrych, but
should work with other Ubuntu 12.04 compatible systems as well.

Additional details on the Centrych version of Wireshark are listed at:
http://www.centrych.org/wireshark

A walk-through on installing and setting up snort and suricata
instances is available at: http://www.centrych.org/idsutil

An Ubuntu 12.04 compatible PPA with all the required packages are
available from: https://launchpad.net/~centrych/+archive/security

Centrych can be downloaded from: http://www.centrych.org/downloads

If you're using another distribution, you can obtain the python source
as well as patch files for Wireshark and Barnyard from:
https://github.com/CentrychOS/python-idsutil

Enjoy,

- -jack-

Jack Radigan
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iQEcBAEBAgAGBQJTOwwjAAoJEG9x8hW2IFbRM8MIAIMeoY+sp4D9M1u9Ug7UutpQ
Qhk0+bkBBLdHQhDjE8wk0FSNUAhQpgDoTXUuSwPkFAqDjRJyVW04Dc+RU0nGfS4F
xpkSKrHSu5AZiSZEVEXpMbhc1vMMs4fG3+zf9dAvozM2iCuxJFixeqOM5ZxP6zkx
0/63Kt8btGo/Vkbr6IXzaVlBB4d/M1oZtkDvqug1x0VEClFarbSyd+JHOfsQUPIv
NGygpeWDm7SmtrKsU7MCGPTF06pBvoNSoL9GwDTsIM/A5dD7KE/np31TOGSCCLgU
xo8mIJcKLl8N3qaxhck7DTLDA0DMnoyMmigb/zQ8tJ2P/clEp02LDOY/w8JjNxA=
=vc7V
-----END PGP SIGNATURE-----