Re: Ability for SIM to perform tcp stream reassembly

[Ron Gula <rgula () tenablesecurity com>]

At 10:19 PM 9/23/2005, Thyrymn () gmail com wrote:
> Hello.
>
> I am currently evaluating some SIM products, however, I am having 
> difficulty getting the vendors to understand what I mean by tcp stream 
> reassembly.
>
> One of the thinfgs I want the sim to do is the be able to take raw packet 
> data -- i.e., what is in tcpdump -r  file -s0 -- search it for a text 
> string, and turn it into a file.
>
> Right now, what I have to do it take the a known time that an event 
> happened, unzip it, tcpdump -r file -w file2 <some filters here>, tcpflow 
> -r file2, and grep <string> * to find what legal has requested.
>
> Anyone know of which ones having this capability built in or can add it on?
>
> Thanks,
> Thy

Not sure if you want a SIM or a network monitoring tool. I'd recommend almost
any of the products in this review below:

http://www.secureenterprisemag.com/showArticle.jhtml?articleID=46200273

Ron Gula, CTO
Tenable Network Security


------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
------------------------------------------------------------------------