Tagged Questions
6
votes
1answer
493 views
How can an admin choose which Snort rules to enable?
The purpose is to configure Snort as an IDS to monitor network activity, and alert against the standard set of things an IDS should alert against--> buffer overflow attacks, injection
attacks, port ...
1
vote
1answer
157 views
SNMP trap by legitimate program?
Is there any way to tell if this SNMP trap is something created by a legitimate program?
Update: Hex Dump
0000000: 30 82 00 ec 02 01 00 04 06 70 75 62 6c 69 63 a4 82 00 dd 06 82 00 09 2b 06 ...
0
votes
2answers
1k views
Snort false positive?
I've set up snort and am configuring it for my network. I have one vpn server making a connection to my dns/AD server. This connection sets off:
GPL SHELLCODE x86 inc ebx NOOP
The payload is as ...
4
votes
2answers
489 views
How effective is an IDS at catching targeted attacks
I have recently become very familiar with IBM Site Protector. As I understand things, Site Protector is in the top tier of IPS/IDS systems, used by some of the largest Fortune 500 companies.
I was ...
1
vote
1answer
179 views
types of intrusions on host [closed]
I am implementing an IDS and just want to know that what are the possibilities with which the intrusion can occur.I am just doing a literature survey over the atacks possible so I want to know that ...
4
votes
1answer
235 views
Attacks against HIDS software running on the same machine
I am interested in the attacks that could be used to compromise or disable HIDS software such as Tripwire or Samhain. I understand that ideally checks should be run periodically and the database ...
6
votes
4answers
454 views
Is Stonesoft's “advanced evasion technique” a major problem?
A month ago, Stonesoft (an IDS constructor from Finland) has launched an alert about Advanced Evasion Techniques.
With these techniques, they claim to be capable of launching attacks on a network ...
18
votes
7answers
4k views
Can I detect web app attacks by viewing my Apache log file?
I occasionally get clients requesting I look at their access_log file to determine if any web attacks were successful. What tools are helpful to discern attacks?
