Re: IPS with no IP address?

["Brad McGary" <bmcgary () secondfront net>]

Jeff,

As far as I know these guys http://www.nitrosecurity.com/ pioneered the
concept of the stackless control channel. Basically directing control
packets towards an IP on the opposite side of the device. They wrote
snort-inline and hogwash.

Here's my feeble attempt at describing the process:

Stackless Control Channel - AES encrypted packets directed through the
appliance by attempting to send traffic to a host on the opposite side
  Recognizer - Code running on the appliance capable of interpreting
encrypted control packets, decrypting them, and executing the embedded
instructions

  Control Panel - GUI interface generates control packets and directs them
through the appliance

  Each packet that passes through the appliance is checked for a "magic
token" in the payload. If the token is found, the appliance will attempt to
decrypt the payload following the magic token. If the token is found again
immediately following the first magic token, the appliance knows it has
found a control packet and processes the command.

  The innovative stackless architecture offers optimal placement for packet
inspection and interdiction without necessitating network topology
modifications. Bi-directional access means it's possible to manage the
device securely from anywhere on the globe that supports Internet
connectivity.

  Hope this helps.



----- Original Message ----- 
From: "Jeff McCarthy" <intel1914a () yahoo com>
To: <focus-ids () securityfocus com>
Sent: Wednesday, January 05, 2005 2:17 PM
Subject: IPS with no IP address?


> Hello,
>
> I recently sat in on an IPS vendor presentation. They
> stated that their IPS has 2 Ethernet interfaces,
> neither of which have IP addresses yet they can manage
> and monitor the device over IP.  I thought this was
> interesting and somewhat unique.
>
> Are there any other vendors that do that? I know at
> least one other vendor has no IP on the interfaces
> listening to traffic but they have a seperate
> interface with an IP for management.
>
> Thanks,
>
> Jeff McCarthy
> USM
>
>
>
> __________________________________
> Do you Yahoo!?
> Yahoo! Mail - Easier than ever with enhanced search. Learn more.
> http://info.mail.yahoo.com/mail_250
>
> --------------------------------------------------------------------------
> Test Your IDS
>
> Is your IDS deployed correctly?
> Find out quickly and easily by testing it with real-world attacks from
> CORE IMPACT.
> Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
> to learn more.
> --------------------------------------------------------------------------



--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from 
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
--------------------------------------------------------------------------