Honeypot / Nessus help

["Jeremy Hyland" <hylandj () u washington edu>]

Nessus has got to be the best network vulnerability scanner available, but
you need to remember it was never designed to be a stealth tool. Most of its
attacks and scans are really in your face - like smacking your server with a
baseball bat. Your IDS would have to be really, really bad to miss it.
However there are some IDS evasion features you can turn on:

 

http://www.nessus.org/doc/nids.html

 

I'd suggest some creative netcat, hping, and nmap work to determine how good
that IDS really is.

 

-Jeremy

 

 

On Fri, 24 Sep 2004 12:09:56 -0700, Robert McMahon <bob () intoto com> wrote:

> Hi,

>

> I'm trying to evaluate an Intrusion Detection/Prevention product which

> advertises support for thousands of signatures.

>

> I'm thinking of using Nessus and a honeypot to exercise the product.

> I'm new to the tools/technology and was wondering if anybody has opinions

> on if these are the right tools?  Also, should I use honeyd or some

> other honeypot?  (My initial look at honeyd suggests it is a bit

> premature, but like I said, I'm a newbie.)

>

> Thanks in advance for any help and tips,

>

> Bob McMahon

> Application Engineer

> Intoto Inc.

> bob () intoto com

>

>