Re: Intrushield vs ISS

[Matthew LeGrow <mlegrow () nfr com>]

Dave Aitel wrote:
> Interesting, because this means Intrushield must parse MSRPC and SMB 
> correctly. This is actually quite rare in an NIDS or NIPS. It'd be good 
> to see what NFR and some of the other heavy hitters do.

For NFR Sentivist, we reassemble MSRPC fragments before analyzing the 
traffic, including MSRPC over SMB and web (via CIS).  Any anomalies in 
MSRPC fragment reassembly will also kick off alerts.

A pseudo-whitepaper written to help teach N-Code function callbacks 
appeared in our last quarterly newsletter here and describes the MSRPC 
over SMB interaction in some detail:

http://www.nfr.com/newsletter/fall-04/AdvancedN-CodeFUCallbacksPackageIntegration.htm

--
Matt LeGrow                 NFR Rapid Response Team
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
| 800-234-4079  (nfr)(security)  Fax:240-632-0200 |
| http://www.nfr.com/solutions/rapidResponse.php  |
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from 
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
--------------------------------------------------------------------------