Re: Important Comments re: INtrusion Detection

[tqbf () secnet com]

Paul D. Robertson, Sun 15 Feb 98

> I'm curious as to why this is a "bad thing"? Reassembly prior to passing 
> to the packet filtering layer gets rid of a whole class of attack.

Amen. It's 1998. We have gateways that rewrite entire IP headers now and
change their IP addresses. I don't think the "can't reassemble frags"
argument really stands up anymore (in a security application). 

> > I wonder how FW-1 would stack up to the sort of tests that SNI put
> > the various IDS systems through.
> I suppose I wasn't the first to wonder this.

Shhhhhhhhhhh. ;)

-----------------------------------------------------------------------------
Thomas H. Ptacek                                        Secure Networks, Inc.
-----------------------------------------------------------------------------
http://www.enteract.com/~tqbf                           "mmm... sacrilicious"