Scott, If you have not discovered it already, there is a document (a ".chm" file actually) that you can download from the SiteProtector console's help menu. This "pam.chm" contains more information about signatures and tuning. The information is cross-correlated in a variety of ways. In this case, you could have navigated to the information on IPv6, found a list of signatures that trigger at that protocol level, and seen that IPv6_Teredo was one of them.
We use the term signature very loosely. In actuality, PAM doesn't have signatures. There is no table of signature specifications that we could hash. PAM is a collection of protocol parsers and detection algorithms integrated tightly together. This confers a lot of benefits over signature-based systems, more stable performance over time being just one of them. Paul -----Original Message----- From: [EMAIL PROTECTED] On Behalf Of Johnson, Scott Sent: Tuesday, September 12, 2006 12:34 PM To: [EMAIL PROTECTED] Subject: [ISSForum] signature search function: re tredo I found the Teredo signature but by accident. ISS must reinstate the signature search it had in the old policy editor. There is no way to perform a string search to find key words in signature descriptions. This makes it difficult to quickly find what you are looking for. One can not depend on the name of the signature to be descriptive enough. While I am ranting, true signature tuning needs to be implemented. There needs to be a one to one mapping of PAMs to signatures and if that is not enough direct access to the signature. ISS could flag the signature by an md5 hash as to whether or not it is original or modified. Scott Johnson Information Security Electric Reliability Council of Texas www.ercot.com Office: 512-248-3152 Cell: 512-917-9844 _______________________________________________ ISSForum mailing list [email protected] TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum To contact the ISSForum Moderator, send email to [EMAIL PROTECTED] The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328. _______________________________________________ ISSForum mailing list [email protected] TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum To contact the ISSForum Moderator, send email to [EMAIL PROTECTED] The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.
