Tag Info

Hot answers tagged

5

Functionally, they are two different applications, but they are often meshed together because the monitoring process tends to be at the edge off the network. Many times you see UTM (Unified Threat Management) which are firewalls with IPS/IDS services integrated as a subscription. Firewalls serve to control the inbound/outbound connections into an ...


3

I would recommend doing a little reading on the OSI model. It might help shed a little light on this, but I will give you a brief overview so this makes more sense. Remember that these concepts can blend together and a firewall could have all of these features. A traditional network firewall operates at layer 3 and layer 4 of the OSI model, which is IP ...


3

That is what VirtualBox's host-only networking mode is for. It creates a virtual network adaptor on the host and connects it to a virtual network adaptor in the guest. Then you just tell the services running on the host to only listen on the virtual adaptor. See section 6.7 of the VirtualBox manual for more details.


2

Question I have for you is, did you install it (RDMPlus) anywhere (your phone, work, etc)? Normally, with applications like this, when you connect, most applications are mere proxies between your two locations. For example, TeamViewer, whenever you install it, your logs will show what may appear to be strange connections to be interpreted. This is because ...


2

A normal firewall typically works on Layer 3 and 4 of OSI model, a proxy can work on Layer 7. Also another thing that a proxy does is: anonymise the requests. E.g.: A normal firewall can block based on destination / origin IP or TCP/UDP ports. A proxy can block based on protocol (https) and / or url (http://stackexchange.com)... Now most of the modern ...


1

There's actually a simple solution to this: build an application that takes a single command line parameter (the URL) and launches the browser directly with that URL after a confirmation box is shown. Set this application as the default browser. When the system sees a ShellExecute or CreateProcess with a http:// URI as the target, it passes off execution to ...


1

Place the virtual appliance in a secured VLAN, open ip any from the appliance to all IP addresses in the DC so we can ensure all UDP and TCP can be scanned. Give the virtual appliance a virtual interface for each VLAN in the data center Maybe I am missing something. Both your suggestions have you placing this in some form of internal IP Space ...


1

The question is which "view" you want on the network from the vulnerability scanner's Point of view. If you want to include the firewall security in your vulnerability assessment, you should Place the scanner with no access to internet, but on "WAN" side of security boundary in the firewall. Thus, your vulnerability scanner would then alert you if you ...


1

Another solution is to build or modify a existing browser, to not allow any type of external URL typing. You could even have it to use a screen keyboard or such to prevent malicious programs from using SendKeys(); and you could have scrambling screen keyboard and much other security features, And user confirmation if the browser is called externally with a ...


1

"tcpwrapped" refers to tcpwrapper, a host-based network access control program on Unix and Linux. When Nmap labels something tcpwrapped, it means that the behavior of the port is consistent with one that is protected by tcpwrapper. Specifically, it means that a full TCP handshake was completed, but the remote host closed the connection without receiving any ...


1

The word "firewall" just describes some device or software to separate security zones. It is not a description of a specific technical implementation. Implementation range from simple packet filters like iptables at OSI layer 3..4 up to application level gateways at OSI layer 7. (Application) proxies instead refer to forwarding a protocol at the application ...


1

It's certainly possible to block based on more sophisticated protocol detection than simply the port. It's also quite possible that the traffic is being broken by accident. Domestic Internet providers will often assume that their users are doing conventional things and optimise their networks accordingly. One useful test would be to establish a VPN from ...


1

To put this a little more officially as an answer, I believe OSSEC has the options you're looking for. You can create custom rules, configure it to watch specific log files (such as your web server logs), and trigger alarms if certain regex matches or strings are detected. Active response can actually run more or less any command, you just have to place it ...



Only top voted, non community-wiki answers of a minimum length are eligible