Re: IDS Testing tool

[ADT <synfinatic () gmail com>]

On Fri, 11 Jun 2004 01:13:29 -0400 (EDT), Anton A. Chuvakin
<anton () chuvakin org> wrote:
> > Is anyone aware of any open source equivalent of Blade's IDS Informer
> > tool to test IDSes? I am aware that TCPReplay can be used to test IDSes
> > but then we will need to make actual attacks at least once to capture
> > the traffic. Any help would be appreciated.
>
> What's wrong with just blasting it with a vuln scanner? Nessus will
> generate a lot of noise in most NIDSs and can even be tweaked for more
> "noisyness"

Well think about it... a good IDS which limits the number of false
positives should detect the actual exploit.  A vulnerability scanner
is supposed to check for the vulnerability, *not* to run the actual
exploit, b/c then it may crash/root/etc your own box.  Hence, an
exploit should look different then a vulnerability check.  Therefore,
using Nessus or other vulnerability scanners are a crappy way of
testing an IDS.  (Of course if you've got a crappy IDS, then perhaps a
crappy test methodology is ok.)

With that in mind, you can either use Blade's IDS Informer or roll
your own solution using tcpreplay.

-Aaron

---------------------------------------------------------------------------

---------------------------------------------------------------------------