TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems!
----------------------------------------------------------------------------
John,
The RealSecure_Kill is a unique TCP RST packet that severs a TCP session.
There is no listing available on the CustID field.
Many users incorrectly think that the RealSecure_Kill is an attack on their
network, where in fact when they receive an RSKill from a CustID other than
themselves, it means that traffic that originated on THEIR network to the
network of the "rskiller" (another customer who uses RealSecure) was
severed. It is not a hack, it is a defense to suspicious or harmful network
traffic.
Brian Fitch
ISS IDS Named Accounts Engineer
ISS Forum Archives: http://archives.neohapsis.com/archives/iss/
-----Original Message-----
From: Hardenbergh, John H, GOVMK [mailto:[EMAIL PROTECTED]]
Sent: Thursday, February 15, 2001 5:04 PM
To: '[EMAIL PROTECTED]'
Subject: RealSecure Kill
TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any
problems!
----------------------------------------------------------------------------
Occasionally one of our RealSecures will detect a "RealSecure_Kill" packet.
When this happens the console reports in the "additional information field"
a Customer ID. I've never seen a great deal of discussion about the use of
this response mechanism (thankfully I suspect few use it) and I don't
believe I've ever seen a listing matching the ID numbers to a Customer Name
or a mechanism for doing so in a controlled manner form ISS. Does any one
have any information in this area they would be willing share? Thanks
--
Regards, JHH
John H. Hardenbergh | Information Security Center
| AT&T Laboratories
973-236-6656 | Florham Park, NJ 07932
[EMAIL PROTECTED] | The answer is almost always 42
One of the extraordinary things about life is the sort of
places it's prepared to put up with living.
...
It will even live in New York, though it's hard to know why.
Douglas Adams
