Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.

All Questions

Tagged with
Filter by
Sorted by
Tagged with
0
votes
1answer
146 views

Can Snort or Suricata *edit* packet on the fly?

I know that they can detect traffic by rules, but can they modify packets on the go? For example, not only detecting HTTP GET but also adding headers to the GET packet. If they can't, is there an ...
0
votes
1answer
696 views

IDS and IPS placement in network? [duplicate]

What is the good practice for the placement of IDS (NIDS) and IPS? Before the firewall or after the firewall? and why?
3
votes
2answers
466 views

How IDS and Firewall Logs are aggregated and feed aggregated log to SIEM?

I am studying SIEM tools. Firewall logs will be different from IDS logs and even from Antivirus logs. How can log aggregation take place?
0
votes
1answer
2k views

Comparison between WAF and IPS/IDS

I would like to know the difference between WAF and IPS/IDS? Can IPS/IDS handle an attack on a web application? If there are differences functionally between the two applications, how they work ...
0
votes
1answer
304 views

With an IPS in place, do we really need firewalls?

I was reading the article "Do you need an IDS or IPS, or both?" on TechTarget. While reading the author's explanation of IPS this question hit me. If an IPS is a control tool that uses a set of ...
5
votes
3answers
2k views

What is the difference between an anti-virus and an IPS?

As I understand it, an intrusion protection system (IPS) detects anomalous behavior, does detection of protocol anomalies, and does signature filtering that blocks malware, DDoS, etc. An antivirus ...
1
vote
2answers
186 views

How to detect long lived SSH sessioned

I am trying to figure out a way to detect ssh sessions that have been established over a long period of time. I seem to recall that there were ways to detect tcp connections that have been connected ...
1
vote
1answer
285 views

IDP Explicit FTPS False-Positive - “FTP Cmd Telnet Opcode Evasion”

Having just upgraded our FTP server to enforce Explicit FTP over TLS (on the standard port 21), we are experiencing connections failing sporadically, probably around 50% of the time. It's important to ...
2
votes
1answer
325 views

How does advanced firewall scan data (check for signature etc) if it is encrypted?

Let's say for normal web browsing, since it's using HTTPS, all the data will be encrypted. In that case, how does the firewall/IDS/IPS check for signatures to detect anomaly/virus/malware?
3
votes
5answers
6k views

Question about IDS and IPS

I am studying Security Fundamentals on Networks and as a part of an excercise I have the following question: Which of the following statements are true? (Select all that apply) a.- An IDS deals with ...
0
votes
2answers
226 views

How much traffic can a firewall node handle? Any real examples? [closed]

As a part of my research, I need to determine the maximum packets (Internet traffic) can one instance of firewall/ IDS process. I am not sure where to begin though. Your assistance and guidance in ...
2
votes
1answer
176 views

Could encryption become a security breach?

So, I was skimming though this SANS research about skype . Long story short, it says : Skype uses standard cryptographic primitives to achieve strong end-to-end encryption (Berson, 2005).........
-3
votes
1answer
3k views

Difference - Firewall Vs IDS (Intrusion Detection System)? [duplicate]

How firewalls differ from IDS ( Intrusion Detection System ) ? What are the differences between them ?
1
vote
1answer
514 views

Detecting DNS tunneling

I have been trying to detect/establish DNS tunneling. First of all I logged out of my user account of the captive portal. Findings: $ nslookup <somesite> // works fine $ ping <somesite> //...
2
votes
1answer
2k views

Raspberry Pi IDS/FireWall - Should I? [closed]

I was excited to setup an IDS/FireWall with my new Raspberry Pi on a standard home network. Reading threats to SSH and Linux, now I am not so sure. Setup by an experienced amateur I'm now concerned ...
5
votes
2answers
11k views

How can the nmap tool be used to evade a firewall/IDS?

Some techniques are used to secure the operating system against network attacks e.g.: firewalls, antivirus software, an IDS like SNORT, etc. To take advantage of the nmap tool, is it possible to ...
19
votes
4answers
4k views

Detect non HTTP packets using port 80

We are currently doing port whitelisting on our firewalls which is working well but this of course does not prevent the implementation of side channels or the misuse of these ports for other purposes. ...
2
votes
1answer
205 views

Linux (!) Network Architecture for CTF-scenario [closed]

My boss recently enrolled me in an InfoSec training. I am part of the network team, but have limited experience in InfoSec. My first assignment is to draw a layout of a network that will be used ...
7
votes
1answer
3k views

Is it possible to detect DPI (Deep Packet Inspection)?

If one suspects one's packets are subject to DPI, how can it be detected?
3
votes
3answers
3k views

Large amount of foreign IPs hitting out firewall, is this automated scans or are we under attack?

I just got put in charge of a network. In the logs on our firewall I noticed that we had a large amounts of machines trying to connect to port 53 as well as about a dozen other ports. Are these ...
3
votes
0answers
106 views

I'm looking for a decent book on network and infrastructure security [closed]

I'm currently looking for a decent book on network and infrastructure security (especially in the enterprise context). Could you point me to one or two recent books, please? Thanks a lot in advance! ...
1
vote
1answer
1k views

Host-based security architecture for web server network

I am begining with network security and after studying for a while about often used technologies I got to this architecture for my home server (sorry it is not in english). I considered 3 basic ...
0
votes
2answers
143 views

Security devices other than firewall and IDS [closed]

I was just studying about firewalls and IDS/IPS and had a doubt. Are these the only two major security devices that a company invests in? or are there other equipment and security controls?
8
votes
1answer
601 views

Setting up own enterprise SOC

the other day I was talking with a service provider (MSSP) who have experience with operating SOC (security operations centre) 24x7. Their price was rather steep (in the millions range). I don't ...
0
votes
2answers
12k views

What are the difference between IPS and WAF in terms of DDoS?

I have heard about both Web Application Firewalls (WAF) and Intrusion Prevention Systems (IPS). Which is better in preventing a Distributed Denial of Service (DDoS) attack and why?
1
vote
1answer
1k views

How to detect/mitigate UDP port scan using OpenBSD and pf

One of our OpenBSD firewalls experienced a flood of UDP traffic from a compromised host within our internal network. The traffic was exchanged between the compromised internal host and a single ...
0
votes
3answers
8k views

Why do we need IDS/IPS if a firewall is present?

Why do we need IDS/IPS if a firewall is present?
0
votes
1answer
410 views

HIDS that can detect attacks, take immediate action locally, and then report to a central service for re-broadcasting to other systems?

I've been researching this for a bit now and cannot find what I want. So I'm to the point where I'm weighing my options as to how I can proceed. Background I'd like to setup a HIDS that has the ...
2
votes
2answers
9k views

How to block network scans with pfsense?

I am using pfsense as a firewall, and I would like to know how I can stop network scans from enumerating open services and ports.
1
vote
2answers
5k views

Securing a Windows PC

Currently I have an "Antivirus" and Anti Malware software installed. In addition I closed all remote assistance and unused port rules on my firewall. I'd really like to get a complete as possible ...
2
votes
1answer
1k views

IPS/IDS and Firewall Solution(s) to a Small Office

I was tasked with implementing a network security solution for a small real estate agency. They are a typical old-school mom and pops shop, about 15 employees with basic file sharing, printing, and ...
3
votes
1answer
174 views

Tracking down the source of email attacks

For the past week our company's IDS has been blocking 100-200 meeting invite emails per day from a specific client that are loaded with buffer overflows targeted at Exchange 2003. The payloads are ...
38
votes
6answers
234k views

Difference between IDS and IPS and Firewall

The differences between an IDS and a firewall are that the latter prevents malicious traffic, whereas the IDS: Passive IDS: the IDS only reports that there was an intrusion. Active IDS: the IDS also ...
1
vote
1answer
91 views

Moving all servers to routeable IP Addresses

Company I am consulting to wants to move all their servers from private IP space to public IP space. I'm am trying to convince them that this is a bad idea that it makes sense to move only certain ...
2
votes
1answer
3k views

How to find IPS events in sonicwall syslog

I have a sonicwall os firewall, and the security dashboard shows about 9 intrusion prevention events in the last month. Most are called "Suspicious CIFS traffic 4". I have syslog servers setup with ...
3
votes
2answers
903 views

Enterprise IDS - Deployment & Uses

I am investigating deploying the Snort IDS for an enterprise environment. This environment consists of a NOC that manages several servers, mainly internal but some internet facing. There are several ...
23
votes
5answers
5k views

Neural networks & anomaly detection

Neural networks, with their ability to learn behavioural patterns from arbitrary data, seem like a natural way to deal with intrusion detection. There are many academic papers on the topic which ...
2
votes
1answer
493 views

IDS/WAF scenario for 2 web servers

I'm running 2 web servers on 2 different physical hosts at home. They handle both HTTP and HTTPS traffic. I want to protect against web application attacks, but don't want to spend money for ...
1
vote
3answers
5k views

Power friendly home router, firewall, IDS/IPS setup? [closed]

For those that like to manage their own firewall and run IDS/IPS on their home networks, I'm curious - what are you using and is it power friendly? I used to have a shelf full systems doing various ...
21
votes
5answers
14k views

Do you detect/react to DNS tunnelling?

I've just seen a talk about tunnelling TCP/IP over DNS requests, because port 53 UDP is usually open and unfiltered. What techniques exist to detect and block such tunnels, and have you ever seen that ...