RE: TippingPoint Releases Open Source Code for First Intrusion Pr evention Test Tool, Tomahawk

["Maynor, David (ISS Atlanta)" <dmaynor () iss net>]

Plus it is a great way to keep people from seeing what you are actually
doing. If you can't view the cap how do you know about the contents?

-----Original Message-----
From: Ron Gula [mailto:rgula () tenablesecurity com] 
Sent: Wednesday, November 03, 2004 9:11 AM
To: focus-ids () securityfocus com
Subject: RE: TippingPoint Releases Open Source Code for First Intrusion
Pr evention Test Tool, Tomahawk

At 11:00 AM 11/2/2004 -0600, Compton, Rich wrote:
> Why the heck would a pcap be confidential?

There is a great deal of effort in generating pcap files.

On one hand, if you have 'live' traffic captured from a
university or corporation, there is a ton of sensitive
data like email and password in it.

On the other hand, if you have a lab, and your IDS/IPS
guys have actually taken the time to configure several
*hundred* different target systems, generate traces for
the several *thousand* common attacks and throw in traces
of Nessus, NeWT, eEye, ISS, NMAP, .etc and then throw in
traces of the web attacks permutated with the dozen or
so evasion techniques, one can see that the sheer effort
of cataloging, capturing and maintaining this data makes
it confidential.

Ron Gula, CTO
Tenable Network Security
http://www.tenablesecurity.com
Lightning   - Enterprise Security Manager
Thunder     - Enterprise Log Manager
NeVO        - Passive Vulnerability and Intrusion Sensor
Nessus/NeWT - Network and Host vulnerability Scanning







------------------------------------------------------------------------
--
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from 
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708

to learn more.
------------------------------------------------------------------------
--



--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
--------------------------------------------------------------------------