RE: IDS testing tools

["Tony Haywood" <thaywood () karalon com>]

Aaron, 

Just to let you know Traffic IQ Pro www.karalon.com now has over 1000 pcap
files in the product and a single perpetual license is only $4,800, not bad
value when you consider that it includes a CLI, full packet editor and lots
of other capabilties and all of the files are of the highest quality.  

Best 
Tony  

-----Original Message-----
From: listbounce () securityfocus com [mailto:listbounce () securityfocus com] On
Behalf Of Aaron Turner
Sent: 14 September 2006 20:36
To: focus-ids () securityfocus com
Subject: Re: IDS testing tools

On 9/14/06, Akira Matsuno <catchb0dhi () gmail com> wrote:

> Is nidsbench still a good tool to use , or is it significantly out of date
now?

Well nidsbench is usually considered a suite of tools:

- Fragroute/Fragrouter - Quite amazing how many IDS/IPS's still have
problems with this, especially at higher rates or under load.  Neither in
active development AFAIK.

- Tcpreplay - Still in active development
(http://tcpreplay.synfin.net/) and very useful if you have relevant pcap's
to play with.  If you don't already have good pcaps, you'll probably have a
hard time finding quality ones which have already been vetted.  Maybe one
day http://openpacket.blogspot.com/ or some other service will actually
launch.

--
Aaron Turner
http://synfin.net/

------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from CORE
IMPACT.
Go to
http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=in
tro_sfw
to learn more.
------------------------------------------------------------------------

------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw 
to learn more.
------------------------------------------------------------------------