Penetration Testing mailing list archives
Re: IDS Assessments....and the I{D|P}S evasion research project
From: "Eric Hacker" <my.self () erichacker com>
Date: Fri, 17 Nov 2006 09:01:27 -0500
To help us automate the correlation, we bound each individual test case to a unique source port, and included the source port in the file name. (Well, we used N for 9, because the exploit couldn't write a 9, but you get the idea). So that way we knew that for a given suite of tests, source port 30000 was test X. Even if you can't do the rest of it, keying each test case to a source port is an enormous help in correlation.
Yes, correlation is important and a very good idea. I forgot about that. Wherever possible use things like source port, IP ID, TCP seq numbers, etc. to discriminate attacks and allow easier correlation. I've set the IP ID field to the Snort ID in some testing. Even though it didn't end up being used for correlation in the end, it helps in debugging when reading packet traces. -- Eric Hacker, CISSP aptronym (AP-troh-NIM) noun A name that is especially suited to the profession of its owner I _can_ leave well enough alone, but my criteria for well enough is pretty darn high. ------------------------------------------------------------------------ This List Sponsored by: Cenzic Need to secure your web apps? Cenzic Hailstorm finds vulnerabilities fast. Click the link to buy it, try it or download Hailstorm for FREE. http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW ------------------------------------------------------------------------
Current thread:
- IDS Assessments....and the I{D|P}S evasion research project Joseph McCray (Nov 15)
- Re: IDS Assessments....and the I{D|P}S evasion research project Sam Gorton (Nov 16)
- Re: IDS Assessments....and the I{D|P}S evasion research project Eric Hacker (Nov 17)
- Re: IDS Assessments....and the I{D|P}S evasion research project Eric Hacker (Nov 16)
- Re: IDS Assessments....and the I{D|P}S evasion research project Raffael Marty (Nov 20)
- Re: IDS Assessments....and the I{D|P}S evasion research project Sam Gorton (Nov 16)