Be sure that if it's in your log it hits your web server. The main problem here is the capacity of the net sensor. If you have heavy politics or your machine is not fast enough then some packets will cross your IDS. Are your IDS working on a switched network? Tomas Ledo Guerrero Responsable de seguridad y comunicaciones. ING DIRECT [tu otro banco] Severo Ochoa, 2 28230 Las Rozas (Madrid) Tel. +34 916349200 Fax. +34 916349231 |--------+------------------------> | | Ramiro Antonio| | | Marulanda | | | Zapata | | | <ramarula@CONA| | | VI.com.co> AT | | | INET-1 | | | | | | 23/08/2001 | | | 19:55 | | | | |--------+------------------------> >------------------------------------------------------------------| | | | To: [EMAIL PROTECTED] AT INET-1@INGCCMAIL-CENTRAL | | cc: (bcc: Tomas | | Ledo/Tecnologia/INGDirectSpain/ING-GROUP) | | Subject: Question! | >------------------------------------------------------------------| ----------------------------------------------------------------- ATTENTION: The information in this electronic mail message is private and confidential, and only intended for the addressee. Should you receive this message by mistake, you are hereby notified that any disclosure, reproduction, distribution or use of this message is strictly prohibited. Please inform the sender by reply transmission and delete the message without copying or opening it. Messages and attachments are scanned for all viruses known. If this message contains password-protected attachments, the files have NOT been scanned for viruses by the ING mail domain. Always scan attachments before opening them. -----------------------------------------------------------------
TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to [EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems! ---------------------------------------------------------------------- ------ Hi. I want to consult something. As me I am able to be sure of who is canceling the connections of attack intents in my Web Server?, that is to say, like I can determine if who makes it the patches they are for the IIS or the RS Network Sensor, do I explain to myself: In the log of events of the Web Server sees registered several access intents not authorized by means of sequences unicode, the same ones are detected and disconnected according to the configuration of the politics of the RS Network Sensor (the RS Console shows this way it). Is the question now, if the one tosses of being registered these events in the log, is it sample that they were not disconnected by the IDS? and that on the contrary, did they arrive to the machine in question?. It is of clarifying that each registration has the description that the answer to the requirement was the code 404 (file not found). Thank you ahead of time for the collaboration that can facilitate me. _____________________________________ Ramiro Marulanda Zapata. Analista de Seguridad Cyberia S.A. (Medell�n-Colombia) Tel. 57(4) 3129320-3129321 E-mail: [EMAIL PROTECTED] _____________________________________
