IDS mailing list archives
RE: TippingPoint Releases Open Source Code for First Intrusion Pr evention Test Tool, Tomahawk
From: Ron Gula <rgula () tenablesecurity com>
Date: Wed, 03 Nov 2004 09:11:05 -0500
At 11:00 AM 11/2/2004 -0600, Compton, Rich wrote:
Why the heck would a pcap be confidential?
There is a great deal of effort in generating pcap files. On one hand, if you have 'live' traffic captured from a university or corporation, there is a ton of sensitive data like email and password in it. On the other hand, if you have a lab, and your IDS/IPS guys have actually taken the time to configure several *hundred* different target systems, generate traces for the several *thousand* common attacks and throw in traces of Nessus, NeWT, eEye, ISS, NMAP, .etc and then throw in traces of the web attacks permutated with the dozen or so evasion techniques, one can see that the sheer effort of cataloging, capturing and maintaining this data makes it confidential. Ron Gula, CTO Tenable Network Security http://www.tenablesecurity.com Lightning - Enterprise Security Manager Thunder - Enterprise Log Manager NeVO - Passive Vulnerability and Intrusion Sensor Nessus/NeWT - Network and Host vulnerability Scanning -------------------------------------------------------------------------- Test Your IDS Is your IDS deployed correctly?Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more.
--------------------------------------------------------------------------
Current thread:
- RE: TippingPoint Releases Open Source Code for First Intrusion Pr evention Test Tool, Tomahawk Ron Gula (Nov 03)
- <Possible follow-ups>
- RE: TippingPoint Releases Open Source Code for First Intrusion Pr evention Test Tool, Tomahawk Maynor, David (ISS Atlanta) (Nov 04)