IDS: Re: Intrusion Prevention

[Vern Paxson <vern () icir org>]

FYI, the way it works is by responding to scans with bogus replies that are
unique to a particular scan.  Then, when subsequent attack traffic includes
the fingerprint left in the bogus reply, the IDS immediately knows that the
traffic corresponds to an attacker (assuming it correctly identified the
initial recon scan as reflecting an attacker); hence, "no false positives".

Disclaimer: I'm on Forescout's technical advisory board, hence have a
direct interest in the company.  (Anti-disclaimer: I joined their board
because I do think their technology is cool. :-)

                Vern