Some questions from Hogwash.sourceforge.net project...

[allen]

A question came up recently in hogwash-devel at lists.sourceforge.net.

The question is, "are you [hogwash guys] planning on integrating with
the Click project"

Hmn...

I would like to "mangle" this question a little bit and throw it at 
you guys at Click.

Hogwash is a Layer-2 "trick" based on Libnet and Libpcap
and Snort.

Simply speaking, hogwash filters [eliminates] anything that trips a snort 
rule rather than merely reporting it.

2 Network Adapters, hogwash in the middle.  

At one point I had worked with Hogwash to construct
"Hogwash-IPTables" - which hangs off of libipq for Linux Netfilter.

http://hogwash.sourceforge.net
and
http://www.prismnet.com/~aef/index2.html

The concept here is interesting.

You are modular and we have a cool module.

Our "obstacles" include that Snort itself, the Rules Engine, is unfortunately,
or was, tightly coupled to Libpcap, so there's plenty of work to unhinge it.
Additionally, Snort likes to look at things from Layer 2...  ...

What is your project popularity ?
What is your development bandwidth ?
Do you have raised eyebrows ?  What are your thoughts ?

THX
-AEF