TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems!
----------------------------------------------------------------------------
I did some reading on TFN2000, and the only thing constant and recognizable
about it's packets is that they all end with an 'A' due to the encoding
scheme it uses. (And I think the TCP packets have the TCP header length set
to zero). It can also spoof source IP addresses (not sure about
destination). If all the signature is doing is looking for an 'A' at the end
of a packet it's not going to be very reliable (1 in every 256 packets?).
Although a lot of 'real' traffic seems to end with a zero's or spaces
because it's been padded.
The destination address that this traffic is using is behind a firewall, and
the firewall is dropping the traffic, so unless there was a TFN daemon
running outside the firewall that was in promiscuous mode sniffing this
traffic, I don't see how it could really be TFN traffic. It could be someone
probing for TFN I guess, but you'd think they'd give up after sending a few
probes a day and not getting a response.
When I log the raw data to the RS log, I find that the logged data all has
an 'A' at the end. If that is all the signature is based on, I can probably
rule them out as false alarms. If it's based on anything more reliable, I
would need to investigate more.
Anyway, I'll have to do some testing I guess.
> -----Original Message-----
> From: Chris St. Clair [SMTP:[EMAIL PROTECTED]]
> Sent: Wednesday, September 20, 2000 2:13 AM
> To: [EMAIL PROTECTED]; [EMAIL PROTECTED]
> Subject: Re: RS Signatures
>
>
> TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message
> to
> [EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any
> problems!
> --------------------------------------------------------------------------
> --
>
> >Signatures.pdf, but others (eg. the TFN2000 one) don't. If it's not
> >documented, how do you know when it's real, and when it's a false >alarm?
>
> Well, you don't. You're basically left to tuning the sigs as best
> you can to decrease the number of false positives.
>
> I've used RS since 2.0 and this has always been a sticking point for
> me with RS. Not all of the sigs are adjustable, and adjusting the
> wrong way can lead to 1) too many false positives to track down if you
> tune it too "rich" or, B) not picking up actual attacks because you
> tuned it to "lean".
>
> I understand that the sig definitions are proprietary and publishing
> the details would allow others to copy them and create an IDS based
> on their work. However, that excuse doesn't help me very much at all.
>
> If you're looking for a fully customizeable IDS that you can have
> full access to sig decodes look into NFR or SHADOW. Granted, you may
> have to do a bit of sig writing yourself, but at least with those you
> actually have that option.
>
> -chris
> _________________________________________________________________________
> Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com.
>
> Share information about yourself, create your own public profile at
> http://profiles.msn.com.
>
>
