Technica Corporation is sponsoring a new open source project. Wizardry, an open source network intrusion detection system, provides protocol analysis as well as deep packet inspection. Target for the Virtex 4 FPGA platform, this project includes several hardware components that enable basic network intrusion detection functionality:
• The Embedded Protocol Analyzing Classifier (EmPAC) is designed to perform the task of packet classification through protocol analysis. Its goal is to take an unclassified byte stream coming from the Ethernet Physical Layer Interface (PHY) and partition and classify the data blocks into corresponding protocol fields. These include header information such as source and destination address, header and payload sizes, and protocol flags, as well as the payload fields themselves.
• The Enhanced Reconfigurable Content Process (eRCP) is a processor designed as a component of Wizardry to perform the task of inspecting incoming preparsed Ethernet frames for matches to Regular Expressions.
• The Reconfigurable Double Data Rate Synchronous Dynamic Random Access Interface Memory Controller (RDIC) provides each component of Wizardry with priority-based Wishbone compliant access to shared memory resources. Each device may access the shared memory space of other components, along with its own personal private (read and write) and reserved (read only) portions of memory. RDIC supports up to 8 separate Wishbone compliant devices.
• The Java Optimized Processor (JOP) is an open source Java Virtual Machine implemented in VHDL that provides an interface to the FPGA. JOP also enables configuration of other components included in Wizardry. This component has write access to the reserved memory space of each component (for configuration data), and has read access to the shared memory space of other components (to retrieve results and output from each component).
• The Web Server provides an interface into the NIDS for the user. As the front end of the Wizardry, the Web Server contains web pages that allow the user of Wizardry to configure modules and view statistics about the state of the FPGA.
http://tech.groups.yahoo.com/group/wizardry_group/