Security Basics mailing list archives
RE: how to block connections running on non-default ports
From: "Smith, Ryan" <Ryan.Smith () MWAA com>
Date: Wed, 17 Aug 2005 14:33:31 -0400
Hi Niranjan, Intrusion Detection Systems are designed to passively monitor your network, and them depending on how your IDS is configured, it will generate an alert when a particular traffic pattern has been detected as a possible attack and/or intrusion into the network . To get the capability to block ports you would need something more along the lines of an IPS (Intrusion Prevention System) which is used inline similar to firewall technology. Just my $.02. Ryan Smith -----Original Message----- From: Niranjan S Patil [mailto:niranjan.patil () gmail com] Sent: Monday, August 15, 2005 11:36 AM To: security-basics () securityfocus com Subject: how to block connections running on non-default ports Hi list, I recently noticed that our corporate IDS could not block some of connections that are seemingly unauthorised. I launched a telnet connection to a remote server on Internet on port 23 and it was successfully blocked by our firewall. I change the listening port of the telnet server to 443 and launched another telnet connection on port 443. Neither our firewall or IDS was able to block this connection. Aren't IDS supposed to block such masqueraded connections, i.e., protocols with non-default ports. I have less knowledge on IDS, but isn't it simple for them to check packet headers and block/filter if they are not on right protocol/port? Is this normal with all IDS? Any help is appreciated. -- Regards, Niranjan S Patil
Current thread:
- how to block connections running on non-default ports Niranjan S Patil (Aug 16)
- RE: how to block connections running on non-default ports Burton Strauss (Aug 22)
- RE: how to block connections running on non-default ports AMOL (Aug 22)
- RE: how to block connections running on non-default ports James Scott-Brown (Aug 22)
- <Possible follow-ups>
- RE: how to block connections running on non-default ports Smith, Ryan (Aug 22)
- RE: how to block connections running on non-default ports Roger A. Grimes (Aug 22)
- RE: how to block connections running on non-default ports abretten (Aug 23)
- Re: RE: how to block connections running on non-default ports nospam_securityfocuscom (Aug 23)