2

Does anyone know how to fingerprint an IPS ? is there any tool available to do the job? I want to detect snort in my network . Would appreciate any kind of help.

  • 2
    If it is running in listening-only mode you might not be able to detect it. – user43488 Apr 21 '14 at 14:00
5

Configured properly, you shouldn't be able to detect snort. "Properly" means on an unconfigured/no-address-assigned port in promiscuous mode. As PTW-105 mentioned, if snort is configured to send resets then maybe you can detect it, but more likely, you'd detect that something was blocking you. The same holds true if it's in inline mode.

Two things I can think of if you really wanted to know it was snort (as opposed to some other IDS/IPS) would be if 1) snort was configured to do logging to some other host and you were able to see that traffic or 2) you could send packets that you know would match snort's ruleset and if you have enough hits, especially for nonstandard stuff or if your packets were so specific that it would probably only drop on snort's detection, you could know that way. But it would be noisy since you were intentionally setting off alarms and if snort was not configured in any sort of active blocking mode I don't know of any way of knowing other than a system that dumped alert data back on the wire in a place you were able to see.

Thanks,

~Patrick

1

I'm not super familiar with snort, but have experience with other IPS products.

As @edvinas.me mentioned, if snort's running in IDS only mode, it's likely that you will not be able to fingerprint it. Some IDS products such as FireEye are sold as an IDS only product when run off a SPAN port, but are capable of doing connection resets if configured as such. This may be one way to actively discover an IDS/IPS product.

Many products that are full-blown IPS products will do a DROP on a connection by default, rather than a DENY on an incoming connection, thus making it difficult to discover and fingerprint.

I don't have it in front of me, but I think the Kali linux distro has some canned tools for fingerprinting IDS/IPS, firewall, WAF, and some other things. May be worth giving a shot at these if you're playing around in your own environment.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.