Re: detecting "intrusion detection"

[Krzysztof Cabaj <kcabaj () gmail com>]

Hi,

> Is there any technique to detect if a particular machine is running an IDS or if a network
> has implemented IDS.
It depends how IDS is configured. For e.g. if IDS check suspicious
machine name using DNS or send RST packet, you could send packet with
forged address and look for potential IDS response. You could also
check if machine has network adapter in promisious mode (send forged
packet with IP of sensor and other MAC address).

But those are only some evidences that this machine is running IDS.
Sometimes this could be very hard or even impossible.

Best regards,
Krzysztof (Christopher) Cabaj

------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
------------------------------------------------------------------------