Re: [PLUG] VNF/eBPF apps

[Michael Lazin via plug <plug@lists.phillylinux.org>]

Sightly off topic since it is not a WAF per se but it does stateful packet inspection very well.  They get the positives from the CISCO talos team.  They are exceedingly good at making rules to detect packet anomalies. 

https://suricata.io.

Michael Lazin

.. τὸ γὰρ αὐτὸ νοεῖν ἐστίν τε καὶ εἶναι.

On Mon, Apr 17, 2023 at 6:44 PM Ron Mansolino via plug <plug@lists.phillylinux.org> wrote:

I'm trying to figure out the requirements for building/deploying VNF/eBPF apps.

Deploying them to appliances usually implies vendor management/orchestration.

What about ordinary *ix distribution/installations?

Can you just write something (eg. monitor/filter) and insert it between the ethernet driver and the rest of the kernel?

(and then how would you install it to specified targets?)

Would a WAF work like this? (How can I keep Apache from seeing and logging obvious bogosity?)

My iptables is unwieldy and I'm wondering if there's a more elegant way to monitor/manage what comes in.

___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug

___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug