misc

基于TCP/IP协议的网络入侵检测系统是在Linux平台下

                             ====================
                                 libnids-1.16
                             ====================

1. Building
-----------

	Libnids uses libpcap (can be retrieved from 
ftp://ftp.ee.lbl.gov/libpcap.tar.Z) and libnet (available at
http://www.packetfactory.net/libnet). All credits to autors of these libs.
	As already mentioned in README, currently libnids will compile on
Linux, any *BSD and Solaris. WIN32 port is mantained separately.
	In order to build libnids, issue "./configure;make" command in top 
directory. Library files libnids.so and libnids.a should be created in "src" 
directory. "make install" will install library and header files.

2. Limitations
--------------

	In their paper, T. Ptacek and T. Newsham observed that various 
operating systems implement IP stack differently and can interpret
differently the same packet. It means that having seen a IP packet, NIDS has 
to interpret it with regard to receiving operating system type. A perfect NIDS
E-component should possess knowledge on all operating systems network 
implementation oddities. I don't know any actual NIDS implementation that 
takes the previous into consideration.
	Libnids 1.0 was meant to reliably emulate behavior of Linux 2.0.36 
kernel. Thanks to libnids testing, some bugs in 2.0.36 networking code were 
found. One of them enabled an attacker to perform blind TCP spoofing against 
2.0.x kernels, including 2.0.36 and 2.0.37 (that is NOT the vulnerability 
discovered by NAI; see my posting to Bugtrag from beginning of August 99). Info
on spotted bugs was submitted to Linux kernel mantainers on 25th May 99 (before
the release of 2.0.37), but none of them got fixed. File PATCH contains diffs 
against 2.0.37, which stop blind spoofing attack and one of data insertion 
attacks (now its equivalent is incorporated into Solar Designer's
secure-linux-0.9 patch). Currently, libnids predicts 2.0.37 behavior as 
accurately as possible (with some unevitable exceptions - see my postings to 
Bugtraq from beginning of August 99). In extreme conditions, libnids can 
incorrectly emulate actions of other operating systems. However, libnids 
should cope with simple attacks (like these implemented in fragrouter 1.3) 
targetted at any OS type.
	All NIDS are vulnerable to DOS attacks. Libnids uses efficient data
structures (i.e. hash tables) to minimize risk of CPU saturation. However, all
NIDS (including ones based on libnids) has to define some resources (most
notably, memory) limits. A determined attacker can attempt to make libnids use 
up all of its memory, which can result in dropping some data. Libnids will 
report such condition via its D-component interface.

3. Why does libnids emulate 2.0.x kernel instead of 2.2.x ?
-------------------------------------------------------

	First of all, libnids development started when 2.0.36 was the current 
stable kernel. Moreover, some people still prefer to use 2.0.x kernels, one of 
the reasons being the fact that there is still no Solar Designer 
non-executable stack patch for 2.2.x (not released oficially until July 99). 
Finally, 2.2.x kernels are highly configurable during run-time (for instance 
it's possible to change via proc interface the amount of kernel memory devoted 
for IP fragments queuing), which generally makes them unpredictable.