block connections in IPS

[Ravi Kumar <ravivsn () roc co in>]

Hi All,
IPS uses TCP Reset or ICMP to block connections. The drawback with this 
approach could be unsuccessful ness in resetting the connection. Do IPS 
have any other mechanism to block connections.
Snort_inline uses TCP reset and ICMP error messages.
The other approach currently followed by some products is to configure 
policies automagically in the firewall to block particular connections. 
This may lead to many false positives.

Is there any mechanism to reduce false positives and effectively block 
connections.
Regards,
Ravi







The Views Presented in this mail are completely mine. The company is not 
responsible for what so ever.

----------
Ravi Kumar CH
Rendezvous On Chip (I) Pvt Ltd
Hyderabad, INDIA

ROC HOME PAGE:
http://www.roc.co.in




-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users