TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to [EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems! ----------------------------------------------------------------------------
Hmm, I'm not sure it's fair to say "so easily confused" because there could well be cases where you would like the IDS to trip for non-SYN packets. A few quick examples spring to mind: (a) if your network load is very heavy and you cannot guarantee capturing and processing every packet then there is a chance that you may not see the initial SYN. (b) you may need to stop/start your sensor [or it could be deliberately taken out of service for a short time] and a session may be initiated during that period. That session could last for hours but your IDS would not indicate any activity if it missed the initial SYN. Okay, this is similar to point (a) but with a different root cause. (c) some port probes use non-SYN packets, and you wouldn't spot those so easily. One way around your problem may be to configure your connection event to only detect traffic to a destination of that port AND your range of IP addresses (depending on how easy that is for you to code, and how restrictive you are willing to make the connection event). HOWEVER I do agree with you that we could have more flexibility in coding rules (eg TCP flags, and/or data at offset, as with Snort etc) and I'm pretty sure that ISS are working on that. Jason On Thu, 30 May 2002 08:05:25 -0700, you wrote: > >TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to >[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems! >---------------------------------------------------------------------------- > >This is my conclusion as well. I was disappointed to see the ISS software >so easily confused. A "Connection Event" should be looking exclusively at >the initiation packet (SYN) and not any old packet headed for a particular >destination port. Hopefully, this is something ISS can correct? > >----- Original Message ----- >From: <[EMAIL PROTECTED]> >Subject: RE: RE: Connection event for port >---------------------------------------------------------------------------- > >That's the return packet (probably a SYN-ACK) establishing the second half >of the connection -- ie when a client sends a SYN to a server to open a >connection, the server responds with a SYN-ACK that simultaneously >acknowledges the connection request and sets up the return half of the >conversation. This is why the next XPU (which will hopefully contain the >signatures for this worm) is being awaited so anxiously... > > > > > > Jason Renard Warning - all views expressed are my own. I cannot guarantee the accuracy of everything I've said - use it at your own risk.
