RE: IPv6 support in IDS/IPS products

["Scott Sloan" <swsloan.ml () gmail com>]

Mike,

Adding IPv6 support is not a trivial process. Can you be a little more
specific? 

-----Original Message-----
From: Mike Barkett [mailto:mbarkett () nfr com] 
Sent: Monday, November 07, 2005 5:26 PM
To: 'Scott Sloan'; 'David Williams'; 'Planz'
Cc: focus-ids () securityfocus com
Subject: RE: IPv6 support in IDS/IPS products

Scott -

There is no performance hit on NFR, as IPv6 support is built into the sensor
engine.

Thanks.
-MAB


> -----Original Message-----
> From: Scott Sloan [mailto:swsloan.ml () gmail com]
> Sent: Monday, November 07, 2005 4:49 PM
> To: 'David Williams'; 'Planz'
> Cc: 'Mike Barkett'; focus-ids () securityfocus com
> Subject: RE: IPv6 support in IDS/IPS products
>
> What is the performance hit when turning on this feature within NFR and
> ISS?
>
> -Scott
>
> -----Original Message-----
> From: David Williams [mailto:dwilliamsd () gmail com]
> Sent: Monday, November 07, 2005 9:51 AM
> To: Planz
> Cc: Mike Barkett; focus-ids () securityfocus com
> Subject: Re: IPv6 support in IDS/IPS products
>
> I'm a little surprised.  I have only heard back from two vendors that
> claim to do full IPv6: NFR & ISS.  I doubt this is an accurate
> representation, so I'll try one more time.  Has anybody heard anything
> about the other products out there?
>
> thanks,
>
> D
>
>
> On 11/3/05, Planz <planz2009 () gmail com> wrote:
> >   As per the below whitepaper, ISS is supporting IPv6 and corresponding
> > tunneling to IPv4 and vice versa, but I have seen no claims by other
> > verdors as well.
> >
> > http://documents.iss.net/whitepapers/IPv6.pdf
> >
> > Besides that, I read an interesting slide on IPv6 Security in the
> > following link:
> >
> > http://www.wareonearth.com/whitepapers/IPv6SecurityIssues.pps
> >
> >
> >
> > Mike Barkett wrote:
> >
> > > David -
> > >
> > > I will pipe up for NFR.  Our Sentivist Smart sensors are natively
> capable
> of
> > > "all of the above" at the sensor engine level.  Tunneling, full
> analysis,
> > > everything.  And we've been doing it for a couple of years now.
> > >
> > > I cannot provide a list of vendors who do this, but I will say that I
> was
> > > told 7 months ago by an IPv6 expert that we were the only IPS vendor he
> was
> > > aware of who did it "properly".  I don't know if that's actually/still
> true,
> > > so I'd be very interested in seeing who else chimes in on this thread.
> > >
> > > Not surprisingly, we find this feature to be very popular in the U.S.
> > > government and overseas, particularly in Asia.  What we try to explain
> to
> > > the rest of the world is that even if they don't think they are running
> > > IPv6, parts of their network may still be at risk of a tunneled IPv6
> attack.
> > > -MAB
> > >
> > > --
> > > (nfr)(security)
> > > Michael A Barkett, CISSP
> > > Vice President, Systems Engineering
> > > (www.nfr.com) +1.240.632.9000 Fax: +1.240.747.3512
> > >
> > >
> > >
> > > > -----Original Message-----
> > > > From: David Williams [mailto:dwilliamsd () gmail com]
> > > > Sent: Sunday, October 30, 2005 9:53 AM
> > > > To: focus-ids () securityfocus com
> > > > Subject: IPv6 support in IDS/IPS products
> > > >
> > > > Hi list,
> > > >
> > > > I've read that some IDS/IPS vendors can monitor IPv6, but not
> > > > completely.  For example, they might be able to alert on the
> > > > presence of IPv6 traffic, but they can't actually do full analysis
> > > > because they can't parse the headers correctly.  Especially for
> > > > things like IPv6 tunneled over IPv4, or IPv6 tunneled over IPv6, etc.
> > > >
> > > > Does anybody have a list of which vendors support what, and to what
> > > > extent?
> > > >
> > > > thanks,
> > > >
> > > > D
> > >
> > >
> > > -----------------------------------------------------------------------
> -
> > > Test Your IDS
> > >
> > > Is your IDS deployed correctly?
> > > Find out quickly and easily by testing it
> > > with real-world attacks from CORE IMPACT.
> > > Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-
> ids_040708
> > > to learn more.
> > > -----------------------------------------------------------------------
> -
> > >
>
> ------------------------------------------------------------------------
> Test Your IDS
>
> Is your IDS deployed correctly?
> Find out quickly and easily by testing it
> with real-world attacks from CORE IMPACT.
> Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
> to learn more.
> ------------------------------------------------------------------------


------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
------------------------------------------------------------------------