RE: block connections in IPS

["Michael Steele" <michaels () winsnort com>]

Geoff,

Another BIG misconception is the ability of Snort to protect a network using
Flex-RESP. It never has been and most likely never will be reliable.

Flex-RESP is not a normal part of Snort. You MUST install it as an add-on.

If you want a good RELIABLE Flex-RESP type of device, then invest in a good
firewall and place it in the appropriate line of fire.

Cheers...

-Michael Steele
-- 
 System Engineer / Security Support Technician     
 mailto:michaels () winsnort com    
 Website: http://www.winsnort.com
 Snort: Open Source Network IDS - http://www.snort.org

-----Original Message-----
From: snort-users-admin () lists sourceforge net
[mailto:snort-users-admin () lists sourceforge net] On Behalf Of Geoff
Sent: Wednesday, October 01, 2003 10:41 PM
To: Snort-users () lists sourceforge net
Subject: Re: [Snort-users] block connections in IPS

I don't think you are correct on what an IPS is. A normal IDS can preform
flex-response (in snort land) which send s resets. Active response features 
like ICMP error codes and shunning (applying dynamic acl's to routered
interfaces or firewalls) are also enployed by different IDS vendors. IPS's
work 
in a different fashion.

They sit inline with your connection (or they are just an IDS).

                |---------------|
|---------|     |               |     |-----------|
| Border  |<--->|       IPS     |<--->|  Internal |
| Router  |     |               |     |  Router   |
|_________|     |_______________|     |___________|
                

Their is nothing that says on IDS can not sit inline as well however an IPS
can ONLY sit in line and IDS can do both and still function. The 
difference is how far the packet goes after detection.

An IPS will drop the packet BEFORE it ever leaves the opposite interface
from where it came in on.
(X = Bad Packet)

                
                |----------------|
|---------|  X  |       X        |     |-----------|
| Border  |<--->|       IPS      |<--->|  Internal |
| Router  |     |(Packet Dropped)|     |  Router   |
|_________|     |________________|     |___________|


Some vendors will also write and ACL on the IN and OUT interfaces of the IPS
for the source/destination IP and PORT pairs and block all traffic for a 
certain time (90 sec).

And IDS will send a reset of apply an acl but that is well after the packet
has reached it destination.

As far as false positives... that is a whole other email :)

Geoff

Ravi Kumar wrote:
> Hi All,
> IPS uses TCP Reset or ICMP to block connections. The drawback with this 
> approach could be unsuccessful ness in resetting the connection. Do IPS 
> have any other mechanism to block connections.
> Snort_inline uses TCP reset and ICMP error messages.
> The other approach currently followed by some products is to configure 
> policies automagically in the firewall to block particular connections. 
> This may lead to many false positives.
>
> Is there any mechanism to reduce false positives and effectively block 
> connections.
> Regards,
> Ravi
>
>
>
>
>
>
>
> The Views Presented in this mail are completely mine. The company is not 
> responsible for what so ever.
>
> ----------
> Ravi Kumar CH
> Rendezvous On Chip (I) Pvt Ltd
> Hyderabad, INDIA
>
> ROC HOME PAGE:
> http://www.roc.co.in
>
>
>
>
> -------------------------------------------------------
> This sf.net email is sponsored by:ThinkGeek
> Welcome to geek heaven.
> http://thinkgeek.com/sf
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users



-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users




-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users