RE: IPv6 support in IDS/IPS products

["Palmer, Paul (ISSAtlanta)" <PPalmer () iss net>]

It is enabled by default in the ISS products. There is no performance
hit.

-----Original Message-----
From: Scott Sloan [mailto:swsloan.ml () gmail com] 
Sent: Monday, November 07, 2005 4:49 PM
To: 'David Williams'; 'Planz'
Cc: 'Mike Barkett'; focus-ids () securityfocus com
Subject: RE: IPv6 support in IDS/IPS products


What is the performance hit when turning on this feature within NFR and
ISS?

-Scott

-----Original Message-----
From: David Williams [mailto:dwilliamsd () gmail com] 
Sent: Monday, November 07, 2005 9:51 AM
To: Planz
Cc: Mike Barkett; focus-ids () securityfocus com
Subject: Re: IPv6 support in IDS/IPS products

I'm a little surprised.  I have only heard back from two vendors that
claim to do full IPv6: NFR & ISS.  I doubt this is an accurate
representation, so I'll try one more time.  Has anybody heard anything
about the other products out there?

thanks,

D


On 11/3/05, Planz <planz2009 () gmail com> wrote:
>   As per the below whitepaper, ISS is supporting IPv6 and 
> corresponding tunneling to IPv4 and vice versa, but I have seen no 
> claims by other verdors as well.
>
> http://documents.iss.net/whitepapers/IPv6.pdf
>
> Besides that, I read an interesting slide on IPv6 Security in the 
> following link:
>
> http://www.wareonearth.com/whitepapers/IPv6SecurityIssues.pps
>
>
>
> Mike Barkett wrote:
>
> > David -
> >
> > I will pipe up for NFR.  Our Sentivist Smart sensors are natively 
> > capable
of
> > "all of the above" at the sensor engine level.  Tunneling, full 
> > analysis, everything.  And we've been doing it for a couple of years 
> > now.
> >
> > I cannot provide a list of vendors who do this, but I will say that I

> > was told 7 months ago by an IPv6 expert that we were the only IPS 
> > vendor he
was
> > aware of who did it "properly".  I don't know if that's 
> > actually/still
true,
> > so I'd be very interested in seeing who else chimes in on this 
> > thread.
> >
> > Not surprisingly, we find this feature to be very popular in the U.S.

> > government and overseas, particularly in Asia.  What we try to 
> > explain to the rest of the world is that even if they don't think 
> > they are running IPv6, parts of their network may still be at risk of

> > a tunneled IPv6
attack.
> > -MAB
> >
> > --
> > (nfr)(security)
> > Michael A Barkett, CISSP
> > Vice President, Systems Engineering
> > (www.nfr.com) +1.240.632.9000 Fax: +1.240.747.3512
> >
> >
> >
> > > -----Original Message-----
> > > From: David Williams [mailto:dwilliamsd () gmail com]
> > > Sent: Sunday, October 30, 2005 9:53 AM
> > > To: focus-ids () securityfocus com
> > > Subject: IPv6 support in IDS/IPS products
> > >
> > > Hi list,
> > >
> > > I've read that some IDS/IPS vendors can monitor IPv6, but not 
> > > completely.  For example, they might be able to alert on the 
> > > presence of IPv6 traffic, but they can't actually do full analysis 
> > > because they can't parse the headers correctly.  Especially for 
> > > things like IPv6 tunneled over IPv4, or IPv6 tunneled over IPv6, 
> > > etc.
> > >
> > > Does anybody have a list of which vendors support what, and to what 
> > > extent?
> > >
> > > thanks,
> > >
> > > D
> >
> >
> > ---------------------------------------------------------------------
> > ---
> > Test Your IDS
> >
> > Is your IDS deployed correctly?
> > Find out quickly and easily by testing it
> > with real-world attacks from CORE IMPACT.
> > Go to 
> > http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
> > to learn more.
>
> -----------------------------------------------------------------------
-
> >

------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708

to learn more.
------------------------------------------------------------------------


------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708

to learn more.
------------------------------------------------------------------------


------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
------------------------------------------------------------------------