0

the title said it. Is it possible to detect IDS name and version. If server use Snort as IDS, would I be able to detect it from external PC? And if it's possible how?

  • possible? yes. how? knowledge on how snort works. nuff said – that guy from over there Jul 3 '14 at 21:30
  • Grate answer, probably Snort is the only IDS out there. Snort was just an example, what about OSSEC, Cisco Catalyst etc... Also "how snort works" snort isn't some script written in Python, you say it like it's some toy. – user50366 Jul 3 '14 at 21:33
  • Detect? You mean as a 3rd party, or as the server owner? Snort typically runs passively so there is no way to determine that it is running, let alone what version it is. – schroeder Jul 3 '14 at 21:41
  • 3rd party of course. So Snort doesn't leave any trace, do you know any IDS that leave some evidence? – user50366 Jul 3 '14 at 21:44
  • @user50366: it seems you dont know the differences of snort/bro vs ossec. you should learn about those and how they work first. – that guy from over there Jul 3 '14 at 22:03
2

Network IDS's tend to run passively, so they don't respond to network traffic: they just listen.

No way to get it to respond in such a way as to determine that it is running, what kind, or what version. You'd need to go a different route to glean that info.

  • when on tap/mirror - port, you are right. when it is in the wire or works as ips it might be detected through timing-attacks; you could even detect which rules/rulesets are enabled. speaking of snort, the version doesnt matter (much) – that guy from over there Jul 3 '14 at 22:01
  • @thatguyfromoverthere it would be so difficult to perform timing attacks, but I suppose it might be possible. And maybe if it was actively responding to traffic. But you would be hard pressed to determine the existence of an IDS as opposed to network anomalies/misconfigurations. – schroeder Jul 4 '14 at 1:57
  • yes, and it is also very very noisy, and it is more theoretical than pratical (but we did this, as a proof of concept for a thesis). beside this, i wanted this to be thinkbait for the op :D – that guy from over there Jul 4 '14 at 6:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.