IDS mailing list archives
RE: IPv6 support in IDS/IPS products
From: "Mike Barkett" <mbarkett () nfr com>
Date: Mon, 7 Nov 2005 17:26:14 -0500
Scott - There is no performance hit on NFR, as IPv6 support is built into the sensor engine. Thanks. -MAB
-----Original Message----- From: Scott Sloan [mailto:swsloan.ml () gmail com] Sent: Monday, November 07, 2005 4:49 PM To: 'David Williams'; 'Planz' Cc: 'Mike Barkett'; focus-ids () securityfocus com Subject: RE: IPv6 support in IDS/IPS products What is the performance hit when turning on this feature within NFR and ISS? -Scott -----Original Message----- From: David Williams [mailto:dwilliamsd () gmail com] Sent: Monday, November 07, 2005 9:51 AM To: Planz Cc: Mike Barkett; focus-ids () securityfocus com Subject: Re: IPv6 support in IDS/IPS products I'm a little surprised. I have only heard back from two vendors that claim to do full IPv6: NFR & ISS. I doubt this is an accurate representation, so I'll try one more time. Has anybody heard anything about the other products out there? thanks, D On 11/3/05, Planz <planz2009 () gmail com> wrote:As per the below whitepaper, ISS is supporting IPv6 and corresponding tunneling to IPv4 and vice versa, but I have seen no claims by other verdors as well. http://documents.iss.net/whitepapers/IPv6.pdf Besides that, I read an interesting slide on IPv6 Security in the following link: http://www.wareonearth.com/whitepapers/IPv6SecurityIssues.pps Mike Barkett wrote:David - I will pipe up for NFR. Our Sentivist Smart sensors are nativelycapable of"all of the above" at the sensor engine level. Tunneling, fullanalysis,everything. And we've been doing it for a couple of years now. I cannot provide a list of vendors who do this, but I will say that Iwastold 7 months ago by an IPv6 expert that we were the only IPS vendor hewasaware of who did it "properly". I don't know if that's actually/stilltrue,so I'd be very interested in seeing who else chimes in on this thread. Not surprisingly, we find this feature to be very popular in the U.S. government and overseas, particularly in Asia. What we try to explaintothe rest of the world is that even if they don't think they are running IPv6, parts of their network may still be at risk of a tunneled IPv6attack.-MAB -- (nfr)(security) Michael A Barkett, CISSP Vice President, Systems Engineering (www.nfr.com) +1.240.632.9000 Fax: +1.240.747.3512-----Original Message----- From: David Williams [mailto:dwilliamsd () gmail com] Sent: Sunday, October 30, 2005 9:53 AM To: focus-ids () securityfocus com Subject: IPv6 support in IDS/IPS products Hi list, I've read that some IDS/IPS vendors can monitor IPv6, but not completely. For example, they might be able to alert on the presence of IPv6 traffic, but they can't actually do full analysis because they can't parse the headers correctly. Especially for things like IPv6 tunneled over IPv4, or IPv6 tunneled over IPv6, etc. Does anybody have a list of which vendors support what, and to what extent? thanks, D------------------------------------------------------------------------Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708to learn more. ------------------------------------------------------------------------------------------------------------------------------------------------ Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more. ------------------------------------------------------------------------
------------------------------------------------------------------------ Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more. ------------------------------------------------------------------------
Current thread:
- IPv6 support in IDS/IPS products David Williams (Nov 03)
- RE: IPv6 support in IDS/IPS products Mike Barkett (Nov 03)
- Re: IPv6 support in IDS/IPS products Planz (Nov 07)
- Re: IPv6 support in IDS/IPS products David Williams (Nov 07)
- RE: IPv6 support in IDS/IPS products Scott Sloan (Nov 09)
- RE: IPv6 support in IDS/IPS products Mike Barkett (Nov 09)
- RE: IPv6 support in IDS/IPS products Scott Sloan (Nov 09)
- Re: IPv6 support in IDS/IPS products Jim Bauer (Nov 10)
- Re: IPv6 support in IDS/IPS products Mike Frantzen (Nov 10)
- Re: IPv6 support in IDS/IPS products Planz (Nov 07)
- RE: IPv6 support in IDS/IPS products Mike Barkett (Nov 03)
- <Possible follow-ups>
- RE: IPv6 support in IDS/IPS products Palmer, Paul (ISSAtlanta) (Nov 07)
- Re: RE: IPv6 support in IDS/IPS products barcajax (Nov 09)
- Re: RE: IPv6 support in IDS/IPS products David Williams (Nov 10)
- RE: IPv6 support in IDS/IPS products Palmer, Paul (ISSAtlanta) (Nov 10)