Subject: [clisp-list] We are using Clisp for real-time programmable packet analysis and response

From: [email-masked]
Date: Sat Aug 30 08:00:02 2003

When we were trying to figure out how to implement the next generation
of
packet analysis and response mechanisms, we chose Clisp as our platform
because it afforded us several major advantagtes over any other
solution.

1) Flexibility

We were building a platform for several products and as such we needed
to be
certain that our investment in the platform would pay off many times
over.
To assure this we needed to make certain that no matter what we
ultimately
wanted to do, we could do it and that it would be able to run on
whatever
platforms we had to use it on.  Clisp offers this.

2) Programmability and Development Speed

We build systems that are extremely field programmable.  Our goal is
that
these systems will have GUIs for simple configuration, but that in the
end
we need the ability for the person in control to do anything they need
to
do. We we built a 3-teired system. The GUIs allows people to do the
simple
things that most products allow them to do. The GUI generates output in
a language that is similar to router table languages. This language
allows
you to put lisp statements at various points in the code that it
generates.
That code is then turned into lisp functions that are compiled and run
as
the applicaiton, or can be compiled into lisp functions and altered for
really strange cases. In other words, the GUI generates code that
generates
code, and that code is compiled and executed. The person using these
functions
can intercept the process at any point. In many cases, the ones we
encounter
every day, the GUI does the job. In other cases where creating a GUI is
too
expensive to justify the special case, we use the intermediate language
and
add a few lines of lisp to the control language and as much code as we
need
in loadable lisp programs. So far we have never had to intervene at the
level
of modifying our intermediate compiler output. This makes development of
new
custom and semicustom applications very cost effective and quick, but it
also provides an added benefit that you just don't get anywhere else. A
reasonably skilled programmer with only a limited understanding of lisp
can
build situation-dependent code that does things no competitor can get
close
to and do it in the field.

3) Operational performance

Of course none of this would be worth anything in our packet sniffing
and
analysis platform if we couldn't get excellent performance. And that's
where lisp surprises most folks, but not us. The compiled lisp code
gives us almost the same performance as C code in most cases, but in
some
cases, the lisp beats the C code hands down. For example, we are using
the RegEx and Lexer lisp code that produces string search and analysis
faster than C libraries to allow us to detect patterns within packets
and
change the function of the platform with respec to those data streams as
they
flow past or through our systems. For a field programmable device, this
gives
unprecendented flexibility at wire speeds.

I have used lisp on and off since I was a teenager using an IBM 360, and
even
though I have gone away from it from time to time, and it isn't ideal
for
evrything, there are still things that lisp does that cannot be touched
by
any other programming language. I am not religious about languages, I am
just
a pragmatic person who uses the best alternative I can find. And in this
case,
as in many others, Lisp is it.

FC
-- 

-- This communication is confidential to the parties it is intended to
serve --
Fred Cohen - http://all.net/ - [email-masked] - [email-masked] - tel/fax:
925-454-0171
Fred Cohen & Associates	- University of New Haven - Security Posture

---

From: Paolo Amoroso <[email-masked]>
Date: Sat Aug 30 11:56:02 2003

> because it afforded us several major advantagtes over any other

Cool. Can you please add an entry to the industry applications and/or
success stories page at ALU CLiki?

  http://alu.cliki.net

Paolo
-- 
Paolo Amoroso <[email-masked]>