Penetration Testing mailing list archives
Re: Packet Payload
From: "David J. Bianco" <david () vorant com>
Date: Tue, 29 Aug 2006 20:05:57 -0400
This is perfectly possible, and very feasible for many environments. In fact, I do it routinely. It's part of the Network Security Monitoring methodology. Most NSM practitioners collect IDS alerts, network session information and pcaps, subject to data retention policies and available storage of course. If you want to learn more, check out Richard Bejtlich's book, "The Tao of Network Security Monitoring." There's also an open source NSM suite which can help you collect an analyze all this data: The Sguil project at http://www.sguil.org (of which I am a member). Personally, I've been collecting pcaps for quite some time now, and I can't imagine having to do my job without that. I'm a lot more efficient when I can simply go back to "the source" and check to see exactly what happened. David xelerated wrote:
Im posrting this to the pen-test group, rather than firewall or IDS because it covers many areas. Id like to see what the pro's think about capturing and storing packet payloads from firewalls, ids, etc... everything rather than just loggin the incidents. Im trying to explain to my management how useful the payloads could be if we were ever to really need them, say from a forensics point of view. To give another example, one time I was seeing lots of firewall drops, I could tell what ports, src and dest. but no packet data. To everyone involved it looked like a worm trying to spread. Well in the end it wasnt, infact is was something that was nice to know about, but it was not hostile traffic. But if I had been able to see the payloads i could have seen the data request and known from the start what it was, or was not. What would be really great, is a whitepaper covering this, or enough info/facts that I could throw one together. thanks! Chris C|EH, CISSP ------------------------------------------------------------------------ This List Sponsored by: Cenzic Need to secure your web apps? Cenzic Hailstorm finds vulnerabilities fast. Click the link to buy it, try it or download Hailstorm for FREE. http://www.cenzic.com/products_services/download_hailstorm.php ------------------------------------------------------------------------
------------------------------------------------------------------------ This List Sponsored by: Cenzic Need to secure your web apps? Cenzic Hailstorm finds vulnerabilities fast. Click the link to buy it, try it or download Hailstorm for FREE. http://www.cenzic.com/products_services/download_hailstorm.php ------------------------------------------------------------------------
Current thread:
- Packet Payload xelerated (Aug 29)
- RE: Packet Payload Hirsch, Adam (Aug 29)
- RE: Packet Payload Matt Davis (Aug 29)
- RE: Packet Payload Remad (Aug 29)
- Re: Packet Payload xelerated (Aug 29)
- RE: Packet Payload Remad (Aug 29)
- Re: Packet Payload xelerated (Aug 29)
- Re: Packet Payload Peter Van Epp (Aug 29)
- RE: Packet Payload Clemens, Dan (Aug 29)
- RE: Packet Payload Javier Romero (Aug 29)
- Message not available
- Message not available
- Re: Packet Payload Mike Klingler (Aug 30)
- Message not available
- Re: Packet Payload David J. Bianco (Aug 30)
- Re: Packet Payload Security (Aug 30)
- RE: Packet Payload Robert D. Holtz - Lists (Aug 30)
- Re: Packet Payload griffkc (Aug 31)
- RE: Packet Payload Robert D. Holtz - Lists (Aug 30)
- Re: Packet Payload Ariel Waissbein (Aug 30)
- Re: Packet Payload xelerated (Aug 30)
- <Possible follow-ups>
- RE: Packet Payload Hirsch, Adam (Aug 29)
- RE: Packet Payload Clemens, Dan (Aug 29)
- Re: Packet Payload xelerated (Aug 29)
- Re: Packet Payload Joey Peloquin (Aug 30)
- RE: Packet Payload Clemens, Dan (Aug 29)