New answers tagged

0

Can someone give me a clear and correct definition of IDS in respect to DPI and vice versa? I think there is none. IDS, IPS, Firewall, NGFW, UTM, DPI ... are terms which describe a task but not how is the task technically implemented. This results in a wide variety of solutions which all use the same terms and buzzwords but vary a lot in the ...


3

IDS can cover deep packet inspection, or a simple look at connection types, or anything in between. You can have Network IDS or Host IDS, depending on what you want to focus your attention on. DPI is a very specific type of analysis of packet contents in order to understand what the purpose of the communication is. Signature Based Detection does not ...


0

This is when Snort detect some kind of sensitive data (email or social security number). The Sensitive Data preprocessor is a Snort module that performs detection and filtering of Personally Identifiable Information (PII). This information includes credit card numbers, U.S. Social Security numbers, and email addresses. A limited regular expression syntax ...


2

Stream. Here is a good document regarding how snort uses libpcap to apply heuristic and signature based anomoly detection to network traffic; http://www.pearsonhighered.com/samplechapter/157870281X.pdf and when in doubt consult the manual https://www.snort.org/faq/readme-stream5


0

Changing the checksum_mode to none in the snort.conf file (config checksum_mode: none) solves the problem and I can now see alerts for the relay rule in my log file.


1

HIDS is very much overkill for a home PC unless you are doing something super-sensitive. More importantly though, HIDS is reactive and to react, you have to monitor it. So the HIDS app is only a part of the solution. You need event reporting and collation and you need both eyes on the output and a way to do something if you get an event. I've seen far too ...


3

So in overall,which one should I prefer ? You should prefer the one where you are able to deal with the logs and how much security you need and how much time you can invest to deal with false positives. Static signatures will fail to catch new attacks but have usually less false positives. Heuristics might catch more new malware but this usually comes ...



Top 50 recent answers are included