Snort mailing list archives
Re: block connections in IPS
From: Geoff <gpoer () arizona edu>
Date: Wed, 01 Oct 2003 22:41:11 -0700
I don't think you are correct on what an IPS is. A normal IDS can preform flex-response (in snort land) which send s resets. Active response features like ICMP error codes and shunning (applying dynamic acl's to routered interfaces or firewalls) are also enployed by different IDS vendors. IPS's work in a different fashion.
They sit inline with your connection (or they are just an IDS). |---------------| |---------| | | |-----------| | Border |<--->| IPS |<--->| Internal | | Router | | | | Router | |_________| |_______________| |___________|Their is nothing that says on IDS can not sit inline as well however an IPS can ONLY sit in line and IDS can do both and still function. The difference is how far the packet goes after detection.
An IPS will drop the packet BEFORE it ever leaves the opposite interface from where it came in on. (X = Bad Packet) |----------------| |---------| X | X | |-----------| | Border |<--->| IPS |<--->| Internal | | Router | |(Packet Dropped)| | Router | |_________| |________________| |___________|Some vendors will also write and ACL on the IN and OUT interfaces of the IPS for the source/destination IP and PORT pairs and block all traffic for a certain time (90 sec).
And IDS will send a reset of apply an acl but that is well after the packet has reached it destination. As far as false positives... that is a whole other email :) Geoff Ravi Kumar wrote:
Hi All,IPS uses TCP Reset or ICMP to block connections. The drawback with this approach could be unsuccessful ness in resetting the connection. Do IPS have any other mechanism to block connections.Snort_inline uses TCP reset and ICMP error messages.The other approach currently followed by some products is to configure policies automagically in the firewall to block particular connections. This may lead to many false positives.Is there any mechanism to reduce false positives and effectively block connections.Regards, RaviThe Views Presented in this mail are completely mine. The company is not responsible for what so ever.---------- Ravi Kumar CH Rendezvous On Chip (I) Pvt Ltd Hyderabad, INDIA ROC HOME PAGE: http://www.roc.co.in ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- What are the differences between and IPS and IDS? Chhabria, Kavita - Apogent (Oct 01)
- Re: What are the differences between and IPS and IDS? twig les (Oct 01)
- Message not available
- Re: What are the differences between and IPS and IDS? Matt Kettler (Oct 01)
- Re: What are the differences between and IPS and IDS? Ravi Kumar (Oct 01)
- block connections in IPS Ravi Kumar (Oct 01)
- Re: block connections in IPS Geoff (Oct 01)
- RE: block connections in IPS Michael Steele (Oct 02)
- Re: block connections in IPS Ravi Kumar (Oct 02)
- Re: block connections in IPS Geoff (Oct 02)
- Re: block connections in IPS Ravi Kumar (Oct 02)
- Re: block connections in IPS Matt Kettler (Oct 03)
- Re: What are the differences between and IPS and IDS? Matt Kettler (Oct 01)
- <Possible follow-ups>
- Re: What are the differences between and IPS and IDS? Ganu Skop (Oct 04)