2
votes
1answer
58 views

How to configure Suricata to not interfere with virtual machine

I'm currently planning on setting up Suricata as a firewall on my laptop. I'm wondering however if it's possible to set Suricata to not interfere with traffic to and from specific virtual machines ...
2
votes
1answer
98 views

IPS/IDS and Firewall Solution(s) to a Small Office

I was tasked with implementing a network security solution for a small real estate agency. They are a typical old-school mom and pops shop, about 15 employees with basic file sharing, printing, and ...
3
votes
1answer
81 views

Tracking down the source of email attacks

For the past week our company's IDS has been blocking 100-200 meeting invite emails per day from a specific client that are loaded with buffer overflows targeted at Exchange 2003. The payloads are ...
5
votes
3answers
4k views

Difference between IDS and IPS and Firewall

The differences between an IDS and a firewall are that the latter prevents malicious traffic, whereas the IDS: Passive IDS: the IDS only reports that there was an intrusion. Active IDS: the IDS also ...
1
vote
1answer
46 views

Moving all servers to routeable IP Addresses

Company I am consulting to wants to move all their servers from private IP space to public IP space. I'm am trying to convince them that this is a bad idea that it makes sense to move only certain ...
1
vote
1answer
617 views

How to find IPS events in sonicwall syslog

I have a sonicwall os firewall, and the security dashboard shows about 9 intrusion prevention events in the last month. Most are called "Suspicious CIFS traffic 4". I have syslog servers setup with ...
2
votes
2answers
280 views

Enterprise IDS - Deployment & Uses

I am investigating deploying the Snort IDS for an enterprise environment. This environment consists of a NOC that manages several servers, mainly internal but some internet facing. There are several ...
13
votes
5answers
806 views

Neural networks & anomaly detection

Neural networks, with their ability to learn behavioural patterns from arbitrary data, seem like a natural way to deal with intrusion detection. There are many academic papers on the topic which ...
2
votes
1answer
183 views

IDS/WAF scenario for 2 web servers

I'm running 2 web servers on 2 different physical hosts at home. They handle both HTTP and HTTPS traffic. I want to protect against web application attacks, but don't want to spend money for ...
1
vote
1answer
1k views

Power friendly home router, firewall, IDS/IPS setup?

For those that like to manage their own firewall and run IDS/IPS on their home networks, I'm curious - what are you using and is it power friendly? I used to have a shelf full systems doing various ...
17
votes
5answers
6k views

Do you detect/react to DNS tunnelling?

I've just seen a talk about tunnelling TCP/IP over DNS requests, because port 53 UDP is usually open and unfiltered. What techniques exist to detect and block such tunnels, and have you ever seen that ...