Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've see the PVS (passive vulnerability scanner) from Tenable Network Security.

I'm really interested in this kind of approach.

Anyone know if is there any FOSS solution to be used professionally in a company ?

P.S. I know that, from the point of view of functionality, is a sort of NIDS with pattern matching engine with a database of vulnerability, so please don't response to use a a NIDS.

share|improve this question
add comment

1 Answer

At a glance, this looks to me as just being a network-based intrusion detection system (Network IDS, or NIDS) with a few special rules. It probably doesn't do anything that Snort couldn't do with the proper tweaks.

share|improve this answer
    
Snort is still the king in IDS-land, but I'm not sure Snort does what PVS does. OpenVAS with a Snort scan for new hosts seems to be the closest to what the OP suggests. –  schroeder Jan 5 '12 at 15:28
1  
@schroeder As I understand it, Snort can pretty much alert to any network transmission you can build a signature for. And I don't see Tenable advertising that PVS does anything that you couldn't (at least in theory) build a signature for. –  Iszi Jan 5 '12 at 15:55
    
PVS will perform a vulnerability scan on any new machine it detects, which is not a Snort function. Snort reads traffic, it does not perform active scans. –  schroeder Jan 5 '12 at 20:04
1  
@boos - Snort is not only very configurable, but many popular rule sets are available for free. Plus - it isn't a hack - snort is designed to be tinkered with in this way. –  Rory Alsop Jan 9 '12 at 21:19
1  
@boos - yes I do know these products pretty well. Seriously, have a look at the snort community forums: many of these rules exist already. –  Rory Alsop Jan 14 '12 at 21:10
show 5 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.