-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Byron,
Martin is right. You will want to pick up a "big iron" that does multi-gig packet generation made by companies such as Xtramsus, Spirent, and so on.. Although, the price point isn't for the faint of heart.. The tools you mentioned won't really even work with Snort since the improvements Martin mentioned in its capabilities in maintaining state - -- which was done quite some time ago in earlier versions of Snort. You would need to disable the stream4 preprocessor for those tools to even work since Snort will require a completed three-way handshake. The reason Martin mentioned the packet generators is to shove gigs of traffic through your Snort sensor while also popping some attacks through it to test the accuracy of Snort and whether any attacks went through undetected. You may also want to check out a tool called IDSInformer. This tool relies on a dual-nic system which allows it to complete the three-way handshake before launching the attack. Although, it is commercial, but I believe they still offer a trial version. Best Regards, Eric Hines, GCIA, CISSP CEO, President Applied Watch Technologies, LLC - --------------------------------------------- Eric Hines, GCIA, CISSP CEO, President Applied Watch Technologies, LLC 1095 Pingree Road Suite 213 Crystal Lake, IL 60014 Toll Free: (877) 262-7593 ext:327 Direct: (847) 854-2725 ext:327 Fax: (847) 854-5106 Web: http://www.appliedwatch.com Email: [EMAIL PROTECTED] - -------------------------------------------- "Enterprise Open Source Security Management" Martin Roesch wrote: > Byron, > > This may sound a bit snippy but it's not pointed at you, I'm just > frustrated with the tools that are out there. :) > > Stick and Snot do *not* test Snort, they haven't tested Snort in any > meaningful way for years, and they only "tested" Snort in their > original form for a few months in 2001 while I made things more > stateful. If you really want to test Snort for performance you should > probably start thinking about investing a few hundred $k in some gear > from Spirent or maybe Ixia for load generation and then get metasploit > for attack generation. A properly configured Snort on a fast enough > platform will take gigabit switches and high end test equipment to > generate enough traffic to simulate anything that will tax it. > > Without the load generation gear all you can do is functional testing > of Snort and for that you should probably be looking at metasploit/ > fragrouter/scapy/etc for that sort of thing. > > I don't know if FPG is capable of doing anything with rules that use > flowbits or relative offsets from previous detections, much less regex > rules. This includes the vast majority of rules that are developed for > Snort these days. Mucus is in the same boat, it was built for Snort > version ~1.8.3-6, it will be unsuitable for testing modern versions of > Snort if the latest release (from 2003) is any indication. > > Stick/snot/sneeze/fpg/mucus are not suitable ways of testing Snort's > "throughput", let's all try to remember that from this point on, we've > been saying it for years. If you want to get a really accurate > measurement of how Snort performs, you should be putting it into an > operational environment where it's going to be deployed and tune it > suitably for that environment and then see what the numbers look like. > That's the absolute best way, doing repeatable network-based testing is > the next best way and after that you've got a variety of non-repeatable > or irrelevant testing setups that won't show you anything meaningful > because they're not repeatable nor are they well scoped. > > What you want to achieve is repeatable functional testing of the engine > components at high bandwidth utilization/packet per second rates. The > repeatable high-bandwidth generation costs lots of money, the > functional testing tools are largely available for free, although there > are a few good commercial tools out there too. > > -Marty > > > On Feb 27, 2006, at 5:54 PM, Byron Sonne wrote: > >>> The tools that come to mind for me are 'stick' and 'snot': >>> http://archives.neohapsis.com/archives/fulldisclosure/ 2004-09/0096.html >>> >>> ---------------------------------------------------------------------- -- >>> Test Your IDS >>> >>> Is your IDS deployed correctly? >>> Find out quickly and easily by testing it with real-world attacks >>> from CORE IMPACT. >>> Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus- >>> ids_040708 to learn more. >>> ---------------------------------------------------------------------- -- >>> > > -- > Martin Roesch - Founder/CTO, Sourcefire Inc. - +1-410-290-1616 > Sourcefire - Security for the Real World - http://www.sourcefire.com > Snort: Open Source Network IDS - http://www.snort.org > > > > - ------------------------------------------------------------------------ Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more. - ------------------------------------------------------------------------ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iD8DBQFEBxbdbOqF2QHgUK0RAq5AAKCmwQJfJlcu655HBH9a7hOU22du9wCeIikO 9B0QMgA88+CbVgRHpBtl3c8= =E7vx -----END PGP SIGNATURE----- ------------------------------------------------------------------------ Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more. ------------------------------------------------------------------------
