> Most likely what the guy is selling (or trying to sell) is some sort of > IDS/network system that grabs the problem packets before they get to the > server's application layer to do damage. Companies like eEye have been doing > this for a long time - have a predefined "these packets are within our > tolerances" baseline and then anything that is outside of it gets squished. > It is actually a good idea (I think) for any machine publicly exposed. You > define the traffic you are willing to take including request lengths, etc > for various ports/protocols and anything outside of that gets dropped and an > error is generated. Maybe it is a new way to access a new app on the box, > maybe it is a new attack style. Either way if say that HTTP request is > composed of more than say x bytes, the http daemon never sees it.
Based on the link just posted, this is probably along the lines of what it is they were trying to sell. I could be wrong, but it still seemed like this vendor is getting information before the rest of the world. I think it is a totally lame approach. The patch distribution problem has been pretty much solved by other vendors. We would all sleep better at night if M$ would just get a clue. Oh well. tim _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
