Free hogwash software for linux

Hogwash is an inline packet scrubber that uses Snorts detection engine to drop malicious packets before they reach the target.

The original version of what is now hogwash was written in 1996 while I was at Idaho State University. I had a web server that when patched, broke the software it needed to run. The box was being taken over every other day so I wrote the very first version of hogwash to filter out the offending packets and name it Scrub.

A bunch of other admins were having the same problem so I distributed Scrub and patches started showing up in my mailbox. It became obvious that some sort of rules language was going to be needed. Over the weekend I wrote the original Cheap and Dirty detection engine.

The summer of 1999 I had an intership at the Idaho National Enviromental and Engineering Labs. They used Snort extensively. I liked the simple layout of Snort so I welded it into Scrub in place of the Cheap and Dirty engine and renamed the project to SnortScrub.

I left the INEEL to work for a startup in the dot-com era. The marketing department considered a commercial version of SnortScrub, but didnt like the name. SnortScrub got renamed to Hogwash as the stackless control channel and other goodies were added to it.

Around this time, Hogwash began to fragment as people needed custom functionality, there were a couple of dozen incompatible versions of Hogwash that were all being maintained seperately. Development of the public version ground to a halt.

As features were added, the Snort engine was showing its weaknesses for doing heavyweight packet scrubbing. The decision was made for resurrecting the old Cheap and Dirty engine and just put a snort compatibility layer on top of it.


That pretty much brings us up to date. The newly dubbed H2 engine will be in final release in the next couple of months.

IPS HLBR program is a fork of the Hogwash project. It is an IPS (Intrusion Prevention System) that can filter packets directly in layer 2 of the OSI model (so the machine doesnt need an IP address).
Detection of malicious/anomalous traffic is done by rules based in signatures, and the user can add more rules. It is an efficient and versatile IPS, and can be used as a bridge to honeypots and honeynets.
Since it doesnt make use of the operating systems TCP/IP stack, it can be "invisible" to network access and attackers. The HLBR is a firewall element.
Enhancements:
- New rules only.