D-WARD package consists of an application and a kernel module. 
Application performs attack detection and calculates rate limits.
Module "rl" enforces rate limits on outgoing traffic.
Module "gst" sniffs packets on the line and passes header info 
to application for statistics gathering.

COMPILING 

Customize indicated fields in Makefile and kernel/Makefile. 
Change configuration files to contain proper source network 
prefix (prefix.config) and customize D-WARD options (dward.config). 
       make depend
       make
       make install
This will compile and install both the application and the kernel module.

Make a dward device by doing
     	mknod /dev/dward c 146 0

Make a sniff device by doing
     	mknod /dev/sniff c 147 0

INSTALLING THE KERNEL MODULE

insmod kernel/gst.o plen=20
insmod kernel/rl.o drop=1 mark=255 LOCAL_ADDRESS=131.179.192.0 LOCAL_MASK=8

For module "gst", plen is an optional parameter showing how many bytes 
from a packet should be preserved and given to application for statistics
gathering. It is defaulted to 40.

For module "rl", drop, mark and LOCAL_MASK are optional parameters, 
and are defaulted to 1, 255 and 0. LOCAL_ADDRESS must be defined, 
otherwise the module will not load. LOCAL_ADDRESS and LOCAL_MASK 
define source network's address space. Mask defines length of 
changeable bits in the address (i.e. bits from the right that 
vary in local addresses). Parameter drop regulates packet dropping. If
it is set to 1 (default value) packets that are deemed attack will be dropped.
If it is set to 0, packets will not be dropped. 
Parameter mark is useful if you are running experiments with 
D-WARD and want to measure its effectiveness. When generating attack
traffic put some number in TOC field of attack packets (say 255).
D-WARD will not use this for decision-making but will gather post-mortem
statistics how many legitimate (TOS!=mark) and attack (TOC==mark) packets
it has forwarded and dropped. These statistics can be found in "stats.txt" file
under "stats" directory.

If kernel crashes after installing the module or during running, 
decrease kernel hash table sizes indicated in dward.config. 

RUNNING DWARD

All instructions are contained in man page. If -s option is given, D-WARD 
expects to find "stats" directory in the current working directory. If -d or 
-dd options are given, D-WARD expects to find "debug" directory in the
current working directory. To delete statistics and debug files do
	make call

Dropped packets will be recorded in /var/log/messages. D-WARD also performs
ingress filtering and will drop spoofed packets. They will also be recorded in
var/log/messages. To avoid overhead of logging dropped packets that could
overwhelm CPU in the case of a large attack, maximum MAX_LOG packets can be 
recorded for each attack.

