Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [intrusion-prevention]

This tag is for questions about any device that performs an intrusion prevention function.

2
votes
2answers
76 views

Obtaining packet switch-port information via a mirrored port?

When sampling a mirrored port of a switch, is there any means of determining the switch-port information of the packet? Since Ethernet packets do not contain this information, I assume the answer is ...
4
votes
2answers
222 views

Is a TCP segment with FIN but not ACK ever encountered today?

A fin-scan involves sending a TCP segment with FIN and no other flags other than (possibly) PSH and/or URG. Are such packets ever legitimately encountered in 2019? Note that in Is a FIN only segment ...
0
votes
0answers
21 views

Intrusion Prevention System detected “ET POLICY PE EXE”, should I worry

I have a UniFi Security Gateway (USG Pro 4P) and just enabled IPS (intrusion prevention system). I am seeing many "ET POLICY PE EXE or DLL Windows file download HTTP" alerts. I have not been able to ...
1
vote
2answers
460 views

What does the output of this tcpdump mean?

Bellow I show the output of my tcpdump What does the first two mean lines means(what are all the question-marks meaning is this a sign of a intruder)? I am especially intrested in the meaning of what ...
1
vote
1answer
113 views

With large file transfer packets are dropped with the error “IDP detection OOO Exceeded Max” on encryption/decryption engine subsystem

We have an in-house application for sending large files. Using TCP/IP this application uploads the files to a server on our main office network and then sends a link to the file as part of an email. ...
10
votes
1answer
268 views

Is a FIN only segment legal?

It would be convenient to mark TCP segments with just the FIN flag set, as an intrusion (without tracking the reply). I have always assumed that a FIN without an ACK, while rude and rare, is legal, ...
2
votes
1answer
133 views

Can scapy specify a source IP when used to simulate SYN / UDP flood attacks

I would like to test an IDS in a test network. I know scapy can be used to generate network traffic, in particluar to simulate fake SYN flood attacks etc like the one here github. All the example ...
2
votes
1answer
204 views

How does Sourcefire IPS understand which application is sending the packet?

I wanted to understand how does the Sourcefire NGIPS understand which application has initiated the traffic. I am aware that the protocol is learned from the ports, but, how does it determine that so ...
1
vote
2answers
94 views

Building an IDS (Special considerations for speed) [closed]

Background I plan to build a Network Intrusion Detection System, (using a dual-homed desktop pc running Debian and Snort) that will sit between my ISP's router (home LAN) and an additional router (...
1
vote
1answer
60 views

In case of an intrusion does changing my private ip/lan ip helps?

In case of an intrusion does changing my private ip/lan ip helps ?
2
votes
1answer
3k views

Juniper SRX 210: Slow upload performance after enabling UTM IDP

I'm refining a Juniper SRX 210 UTM IDP implementation in a small business. I'm new to Junos, so I'm hoping someone will be able to point me in the best-practices direction. The customer initially ...
4
votes
1answer
146 views

Cisco IPS - At what temperature will the IPS halt?

We have an IPS module inside a Cisco ASA. It is an SSM-10. Looking in the show tech of the IPSM I see this line: Halt Device on Over Temp : 1 I believe that means the system will halt when the ...
2
votes
1answer
751 views

ASA 5585-X IPS-SSP image recovery?

ASA 5585-X with SSP-10 and IPS-SSP 60 Slot 0:SSP-10 works fine Slot 1:IPS-SSP-60 is not responsive, ports not coming up, show module cannot detect software version, boot image missing Management 0/...