Re: covert channel detection?

[Ralf Hildebrandt <Ralf.Hildebrandt () innominate com>]

On Tue, Aug 07, 2001 at 07:32:53AM -0400, Hugh Fraser wrote:

> I'd like to do the same thing. In addition to Snort, I'm also using NFR for
> intrusion detection, which has the ability to check the age of a connection with
> each packet received. A simple rule can be written to identify connections which
> are uncharacteristically old (like DNS, HTTP, etc.). I don't see that ability in
> Snort.

A covert channel can be made connectionless e.g. with ICMP packets
going back and forth.

-- 
ralf.hildebrandt () innominate com                            innominate AG
Technical Consultant                   Don't be afraid of what you see -
Diplom-Informatiker                     be afraid of what you don't see!
tel: +49.(0)7000.POSTFIX                        fax: +49.(0)30.308806-77


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users