TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems!
----------------------------------------------------------------------------
>Signatures.pdf, but others (eg. the TFN2000 one) don't. If it's not
>documented, how do you know when it's real, and when it's a false >alarm?
Well, you don't. You're basically left to tuning the sigs as best
you can to decrease the number of false positives.
I've used RS since 2.0 and this has always been a sticking point for
me with RS. Not all of the sigs are adjustable, and adjusting the
wrong way can lead to 1) too many false positives to track down if you
tune it too "rich" or, B) not picking up actual attacks because you
tuned it to "lean".
I understand that the sig definitions are proprietary and publishing
the details would allow others to copy them and create an IDS based
on their work. However, that excuse doesn't help me very much at all.
If you're looking for a fully customizeable IDS that you can have
full access to sig decodes look into NFR or SHADOW. Granted, you may
have to do a bit of sig writing yourself, but at least with those you
actually have that option.
-chris
_________________________________________________________________________
Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com.
Share information about yourself, create your own public profile at
http://profiles.msn.com.
