• System Section
• Interface Section
• Routing Section
• Mangling Section
• IP Lists
• Actions
• Modules

• Interface Tests
• Ethernet Tests
• IP Tests
• ICMP Tests
• TCP Tests
• UDP Tests
• TCPStream Tests
• DNS Tests
• HTTP Tests
• Includes

The routing section is optional. If it's not present, Hogwash will function in IDS mode and not bridge packets between interfaces. Routes are RoutID order. I'm going to change that in the next version so they're applied in the order specified.
Here's the most common routing section:

<routing>
MacFilter(eth0, eth1)
</routing>

SBrige(interface1, interface2)

This is the simplest form of routing. SBrige simply passes packets from one interface to the next without trying to intelligently figure out what's going on. You can only bridge two interfaces with SBridge.

MacFilter(interface, interface, ...)

MacFilter routes solely on the MAC address. It listens for a few seconds to determine which MAC in associated with which interface and then routes accordingly. Broadcast packets are sent out all interfaces except the one that the packet came in on.

MacFilter does add a few second delay when a new machine is placed on the network before it is allowed to talk.

If you have a jabber condition on your network with SBrige (all segments are at 100% usage) whenever you start Hogwash, MacFilter will solve the problem.

Broadcast()

This turns on a specific broadcast packet handler. If you're having problems with Linux kernels duplicating ARP packets, this will solve the problem. You probably won't need this.

SIP(Interface ip1,ip2,...)

SIP routes via the source IP in a packet. All packets that match the given SIP list will be routed out the given interface. Non-IP packets are ignored by this option.

DIP(Interface ip1,ip2,...)

DIP routes via the destination IP in a packet. All packets that match the given DIP list will be routed out the given interface. Non-IP packets are ignored by this option.