Very, very true. Keep in mind the Prelude guys aren't even doing this any more, they've deprecated their own YARBIDS and output_prelude is part of the vanilla Snort source now. Wish folks would invest all this effort in something where there aren't three or four existing OSS tools, like say, vuln scanning... :)
-- shawn > Well, this is a pity, because working on Snort or Bro or Prelude would > have benefited the community a lot more than starting YARBIDS (Yet > Another Rule Based IDS)... ------------------------------------------------------------------------ Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw to learn more. ------------------------------------------------------------------------
