pigasus

Github Repo - https://github.com/cmu-snap/pigasus

What a lovely fond memories of having to research and use the very first several versions of Snort IDS and its first IPS (Hogwash) about 20 years ago [1],[2]. I'd like to test this new system on the cheaper Xilinx ULtraScale+ FPGA using the provided software [3], but not sure will it even work with different FPGA set up with minimum change [4]? Another thing is that it will be interesting to test and compare it with eBPF based IPS system bypassing the kernel without the need for FPGA? It seems that for Suricata IDS/IPS it has been proposed but no performance metrics are provided of the effort [5]. [1] https://www.snort.org [2] http://hogwash.sourceforge.net/docs/overview.html [3] https://github.com/cmu-snap/pigasus [4] https://www.xilinx.com/products/intellectual-property/cmac.h... [5] https://cdn2.hubspot.net/hubfs/6344338/Resources/Stam

Repo is here https://github.com/cmu-snap/pigasus

Yes, in theory. In reality, the premise is that they're looking for attacks in protocols that aren't encrypted, which is part of the reason the approach doesn't make much sense anymore --- the signatures are all tuned for attacks that only really matter in internal networks, and internal networks are already insecure. (You could also park this in between a TLS-terminating reverse proxy and the app servers, I guess). The source code is here: https://github.com/cmu-snap/pigasus --- a lot of it is from Snort.