Full Disclosure mailing list archives
IDS WIth TCP Reset and SPAN
From: "Dain Deutschman" <daind () qwest net>
Date: Tue, 25 May 2004 21:06:29 -0500
Hello Group, Hopefully, this topic is ok to discuss here. I am fairly new to IDS systems and am having trouble getting my cisco IDS to send TCP resets. The lab network is as follows: R4 R1----IDS----| R2------R3 R4 and R2 are on the same ethernet segment. R1 is on Command and Control side of the sensor. The attack is coming from R3 ( telnet to R4 and issue "testattack" string ). The alarm shows up in event viewer...but no tcp reset...I mean...my telnet session stays active. I know this probably has something to do with how I am setting up SPAN on the switch....but I am not sure. The IDS Sensing interface, R4 and R2 are on the same switch and in VLAN 20. R3 is in VLAN 30. I have tried it without span ( just R4, R2 and IDS sensing interfaces in same vlan ) and with span configured as follows. Niether has worked. monitor session 1 source vlan 20 rx monitor session 1 destination int f0/17 ingress vlan 20 Any ideas?? Thanks, Dain
Current thread:
- IDS WIth TCP Reset and SPAN Dain Deutschman (May 25)
- Re: IDS WIth TCP Reset and SPAN dila (May 26)
- Re: IDS WIth TCP Reset and SPAN Ron DuFresne (May 27)
- Re: IDS WIth TCP Reset and SPAN Jason (May 27)
- Bypassing "smart" IDSes with misdirected frames? (long and boring) Michal Zalewski (May 27)
- Re: Bypassing "smart" IDSes with misdirected frames? (long and boring) Aaron Turner (May 27)
- Re: Bypassing "smart" IDSes with misdirected frames? (long and boring) Jim Bauer (May 28)
- Re: Re: Bypassing "smart" IDSes with misdirected frames? (long and boring) Michal Zalewski (May 28)
- Re: Bypassing "smart" IDSes with misdirected frames? (long and boring) Oliver Friedrichs (May 28)
- Re: Bypassing "smart" IDSes with misdirected frames? (long and boring) Jim Bauer (May 28)
- Re: Bypassing "smart" IDSes with misdirected frames? (long and boring) Srini (May 28)
- Re: IDS WIth TCP Reset and SPAN dila (May 26)