RE: IDS Sensor operation

["Joseph Hamm" <jhamm () lancope com>]

Vijai,

Two links you should check out from the ISS Knowledgebase:

Why do I have to select an Adapter for Kills?
https://iss.custhelp.com/cgi-bin/iss.cfg/php/enduser/std_adp.php?p_sid=r
CTgkImh&p_lva=&p_faqid=1026&p_created=1022780331&p_sp=cF9zcmNoPTEmcF9ncm
lkc29ydD0mcF9yb3dfY250PTYmcF9zZWFyY2hfdGV4dD1yc2tpbGwmcF9zZWFyY2hfdHlwZT
0zJnBfcHJvZF9sdmwxPX5hbnl_JnBfcHJvZF9sdmwyPX5hbnl_JnBfY2F0X2x2bDE9fmFueX
4mcF9zb3J0X2J5PWRmbHQmcF9wYWdlPTE*&p_li=

and 

How does a RealSecure Kill (RSKill) work?
https://iss.custhelp.com/cgi-bin/iss.cfg/php/enduser/std_adp.php?p_sid=r
CTgkImh&p_lva=&p_faqid=96&p_created=976872224&p_sp=cF9zcmNoPTEmcF9ncmlkc
29ydD0mcF9yb3dfY250PTYmcF9zZWFyY2hfdGV4dD1yc2tpbGwmcF9zZWFyY2hfdHlwZT0zJ
nBfcHJvZF9sdmwxPX5hbnl_JnBfcHJvZF9sdmwyPX5hbnl_JnBfY2F0X2x2bDE9fmFueX4mc
F9zb3J0X2J5PWRmbHQmcF9wYWdlPTE*&p_li=

The funny thing about TCP resets is that sometimes they work and
sometimes they don't (at least in my experience).  With any type of
mitigation response there are pros and cons.  On the upside, you don't
have to reconfigure one of your network devices to kill the connection.
On the downside, they aren't always reliable.  It might be the case that
this is the only option if there is no network device between the two
hosts.  Of course, that is where blocking at the switch port comes
in......which has its own issues;)

Hope this helps,
Joe

Joe Hamm, CISSP
Security Engineer
Lancope, Inc.
jhamm () lancope com
404.644.7227  (cell)
770.225.6509   (fax)

Lancope - Security through Network Intelligence(tm)
StealthWatch(tm) by Lancope, a next-generation network security
solution, delivers behavior-based intrusion detection, policy
enforcement and insightful network analysis.  Visit www.lancope.com.

Join Lancope for a complimentary Webinar "Exclusive Preview of
StealthWatch System v 4.2" at 11 AM EDT on Wednesday, October 27, 2004.
Register today at
https://lancope.webex.com/lancope/onstage/g.php?d=752017377&t=a.

-----Original Message-----
From: Vijai K (Infosec) - CTD, Chennai. [mailto:vijaik () ctd hcltech com] 
Sent: Friday, September 24, 2004 2:36 AM
To: focus-ids () securityfocus com; Srinivasa Rao Addepalli
Subject: IDS Sensor operation 


Hi folks

 
Basically sensors operates with promiscuous mode interface  for
monitoring
data,rite
But there is an optionality in  an IDS to alert the firewall
(reconfigure)to
block the intrusion IP, and also to kill the session or connectionby the
sensor itself.

this we see in Realsecure Network sensor 7.0 where there  is a option
called
RSKILL.

But the question is how is it possible for a interface in promiscuous
mode
to act like this since there is no binding in the interface(TCP/IP,etc).

Did it uses other NIC which is for management purpose???

Hope u all understand the question



Regds
Vijai.K



DISCLAIMER 
This message and any attachment(s) contained here are information that
is
confidential, proprietary to HCL Technologies and its customers.
Contents
may be privileged or otherwise protected by law. The information is
solely
intended for the individual or the entity it is addressed to. If you are
not
the intended recipient of this message, you are not authorized to read,
forward, print, retain, copy or disseminate this message or any part of
it.
If you have received this e-mail in error, please notify the sender
immediately by return e-mail and delete it from your computer.



------------------------------------------------------------------------
--
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
------------------------------------------------------------------------
--



--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more.
--------------------------------------------------------------------------