IDABench
is a pluggable framework for intrusion analysis built upon the
Naval
Surface Warfare Center, Dahlgren Division's SHADOW versions
1.7 and 1.8.
IDABench is NOT intended to be an intrusion detection
system, although it can be used as such. One of the primary
design goals was to provide intrusion analysts easy
access to the tools & utilities that they already are
familiar with through a convenient web interface. CGI
scripts are extended via simple plugins that pass packet
data to (and output from) libpcap-based tools such as
tcpdump,
tethereal,
ngrep,
etc. As access to other libpcap tools is desired, lightweight
plugins can be written and installed without modifying
existing IDABench code. The only limitation is that the new
tools must be able to read packets that were captured using
tcpdump, or some other libpcap sniffer. Candidates
for plugins include Snort,
p0f,
tcpdstat,
ntop, etc. [See Related Links]
IDABench requires Perl version 5.6.1 or newer. Supported platforms -
- sensor: Solaris, FreeBSD, Linux
- analyzer: Linux
