Full Disclosure mailing list archives
Re: IDS WIth TCP Reset and SPAN
From: Ron DuFresne <dufresne () winternet com>
Date: Thu, 27 May 2004 11:39:57 -0500 (CDT)
I think the cisco IDS was not snort, I forget what product they do use, was not as flexible as snort and other packages, though I do assume that in the 3-4 years since I last played with their IDS toy it has been upgraded and issues with it fixed. but, you are correct, most IDS systems do not do anything much more then monitor the network stream. Snort and other IDS systems can be worked/setup with other tools like the firewalls capabilites to amend the policy in response to what is seen by the IDS in stream. But, one wants to be careful in how they set this up, so that they avoid a sneak attack them 'allows' their IDS/response system to denail service to their core gateway or other resources. Thanks, Ron DuFresne On Thu, 27 May 2004, dila wrote:
As far as I know, Snort has no drop capabilities, hence Intrusion _Detection_ System. I found this using google: http://www.mcabee.org/lists/snort-users/Mar-03/msg00379.html -dilaHello Group, Hopefully, this topic is ok to discuss here. I am fairly new to IDS systems and am having trouble getting my cisco IDS to send TCP resets. The lab network is as follows: R4 R1----IDS----| R2------R3 R4 and R2 are on the same ethernet segment. R1 is on Command and Control side of the sensor. The attack is coming from R3 ( telnet to R4 and issue "testattack" string ). The alarm shows up in event viewer...but no tcp reset...I mean...my telnet session stays active. I know this probably has something to do with how I am setting up SPAN on the switch....but I am not sure. The IDS Sensing interface, R4 and R2 are on the same switch and in VLAN 20. R3 is in VLAN 30. I have tried it without span ( just R4, R2 and IDS sensing interfaces in same vlan ) and with span configured as follows. Niether has worked. monitor session 1 source vlan 20 rx monitor session 1 destination int f0/17 ingress vlan 20 Any ideas?? Thanks, Dain_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ "Cutting the space budget really restores my faith in humanity. It eliminates dreams, goals, and ideals and lets us get straight to the business of hate, debauchery, and self-annihilation." -- Johnny Hart ***testing, only testing, and damn good at it too!*** OK, so you're a Ph.D. Just don't touch anything. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- IDS WIth TCP Reset and SPAN Dain Deutschman (May 25)
- Re: IDS WIth TCP Reset and SPAN dila (May 26)
- Re: IDS WIth TCP Reset and SPAN Ron DuFresne (May 27)
- Re: IDS WIth TCP Reset and SPAN Jason (May 27)
- Bypassing "smart" IDSes with misdirected frames? (long and boring) Michal Zalewski (May 27)
- Re: Bypassing "smart" IDSes with misdirected frames? (long and boring) Aaron Turner (May 27)
- Re: Bypassing "smart" IDSes with misdirected frames? (long and boring) Jim Bauer (May 28)
- Re: Re: Bypassing "smart" IDSes with misdirected frames? (long and boring) Michal Zalewski (May 28)
- Re: Bypassing "smart" IDSes with misdirected frames? (long and boring) Oliver Friedrichs (May 28)
- Re: Bypassing "smart" IDSes with misdirected frames? (long and boring) Jim Bauer (May 28)
- Re: Bypassing "smart" IDSes with misdirected frames? (long and boring) Srini (May 28)
- Re: Bypassing "smart" IDSes with misdirected frames? (long and boring) Mike Frantzen (May 28)
- Re: Re: Bypassing "smart" IDSes with misdirected frames? (long and boring) Michal Zalewski (May 28)
- Re: IDS WIth TCP Reset and SPAN dila (May 26)