Hot answers tagged

5

There are various ways that comes handy with nmap to evade the basic rules of firewall or Intrusion detection system. 1) Packet Fragmentation: This option evade pattern matching detection technique. Since packet reassembly can be quite processor intensive, it's common for admin to disable it. In snort, fragmentation reassembly functionality is disabled ...


1

Nmap has several useful options which can help you evade a firewall/IDS. The effectiveness of these options will depend upon what you are up against, i.e. the system(s) and how they are configured. A properly configured, modern firewall will hinder your scans very effectively. A good breakdown of the nmap options you can use can be found here. Generally ...


1

I was assuming that snort monitors packets in HOME_NETWORK in promiscous mode,Kindly correct me if i am wrong. Snort can only monitor packets which can be seen at the network card, even in promiscuous mode. Usually the switch in a network will only send out packets on the port where the specific device is connected. This means that Snort has to be ...


1

Difficult to say without knowing the network topology, but I'd guess that you've not got snort set up on a SPAN port or similar. If your network is switched, then the snort box won't be receiving traffic which isn't either directed to it, or the broadcast. It may be listening in promiscuous mode, but if the packets aren't actually hitting the interface, ...


1

IDS, IPS, and Firewall are just names describing the capabilities and purpose and are not technical descriptions. The differences are often murky and how a device is called is also affected by marketing. Classical passive IDS like snort can be used inline too to prevent attacks and thus magically get an IPS. And IPS which are just used to watch but not ...



Only top voted, non community-wiki answers of a minimum length are eligible