RE: Active response... some thoughts.

["Kohlenberg, Toby" <toby.kohlenberg () intel com>]

> -----Original Message-----
> From: mb_lima [mailto:mb_lima () uol com br]
> Sent: Monday, January 27, 2003 2:43 AM
> Subject: RE: Active response... some thoughts.
>
> > popular nor, IMHO, effective strategy.  First off, as the em
> ail mentions
> > below, the attacker can just simply hack his stack to ignore
>  the
> > resets...hey, it's possible.  Also, TCP-
> Resets can create a storm of packets
>
>  I don´t agree because TCP RST is sucessful to stop script 
> kiddies. Attacks more sofisticated are few and we know that 
> there are many ways to bypass IDS sensors (more easy ways).

Actually, TCP resets don't work in many cases- for instance any
situation where you have a single packet exploit (say the Saphire
worm that just ran through the Net)... This is the same problem
that router/firewall reconfiguration has- by the time the response
happens, the compromise is done.

toby