Questions tagged [intrusion-prevention]
This tag is for questions about any device that performs an intrusion prevention function.
14
questions
1
vote
1
answer
250
views
Where exactly should snort run?
Apologies for this newbie question, but I am currently exploring IDS and snort is one that I see mentioned a lot. SO now I am looking at how to make use of it.
So let say I have a LAN and I need to ...
- 137
0
votes
1
answer
147
views
What is difference between Misuse intrusion and Signature Based IDS?
Can someone explain me this ? I have been searching the difference between misuse intrusion and signature based over the internet and I have come to a certain point where after reading so many ...
- 1
2
votes
2
answers
86
views
Obtaining packet switch-port information via a mirrored port?
When sampling a mirrored port of a switch, is there any means of determining the switch-port information of the packet?
Since Ethernet packets do not contain this information, I assume the answer is ...
- 169
4
votes
2
answers
539
views
Is a TCP segment with FIN but not ACK ever encountered today?
A fin-scan involves sending a TCP segment with FIN and no other flags other than (possibly) PSH and/or URG. Are such packets ever legitimately encountered in 2019?
Note that in Is a FIN only segment ...
- 169
7
votes
2
answers
11k
views
What does the output of this tcpdump mean?
Bellow I show the output of my tcpdump
What does the first two mean lines means(what are all the question-marks meaning is this a sign of a intruder)?
I am especially interested in the meaning of what ...
- 173
1
vote
1
answer
632
views
With large file transfer packets are dropped with the error "IDP detection OOO Exceeded Max" on encryption/decryption engine subsystem
We have an in-house application for sending large files. Using TCP/IP this application uploads the files to a server on our main office network and then sends a link to the file as part of an email. ...
- 113
11
votes
1
answer
602
views
Is a FIN only segment legal?
It would be convenient to mark TCP segments with just the FIN flag set, as an intrusion (without tracking the reply).
I have always assumed that a FIN without an ACK, while rude and rare, is legal, ...
- 169
2
votes
1
answer
384
views
Can scapy specify a source IP when used to simulate SYN / UDP flood attacks
I would like to test an IDS in a test network.
I know scapy can be used to generate network traffic, in particluar to simulate fake SYN flood attacks etc like the one here github. All the example ...
- 23
2
votes
1
answer
232
views
How does Sourcefire IPS understand which application is sending the packet?
I wanted to understand how does the Sourcefire NGIPS understand which application has initiated the traffic. I am aware that the protocol is learned from the ports, but, how does it determine that so ...
- 163
1
vote
2
answers
98
views
Building an IDS (Special considerations for speed) [closed]
Background
I plan to build a Network Intrusion Detection System, (using a dual-homed desktop pc running Debian and Snort) that will sit between my ISP's router (home LAN) and an additional router (...
- 111
1
vote
1
answer
63
views
In case of an intrusion does changing my private ip/lan ip helps?
In case of an intrusion does changing my private ip/lan ip helps ?
- 11
2
votes
1
answer
3k
views
Juniper SRX 210: Slow upload performance after enabling UTM IDP
I'm refining a Juniper SRX 210 UTM IDP implementation in a small business. I'm new to Junos, so I'm hoping someone will be able to point me in the best-practices direction.
The customer initially ...
- 737
4
votes
1
answer
157
views
Cisco IPS - At what temperature will the IPS halt?
We have an IPS module inside a Cisco ASA. It is an SSM-10. Looking in the show tech of the IPSM I see this line:
Halt Device on Over Temp : 1
I believe that means the system will halt when the ...
- 828
2
votes
1
answer
1k
views
ASA 5585-X IPS-SSP image recovery?
ASA 5585-X with SSP-10 and IPS-SSP 60
Slot 0:SSP-10 works fine
Slot 1:IPS-SSP-60 is not responsive, ports not coming up, show module cannot detect software version, boot image missing
Management 0/...
- 1,281