IDS: RE: ForeScout ActiveScout (was: Re: Intrusion Prevention)

["Matthew L. McGuirl" <mmcguirl () lucidsecurity com>]

They "shine" because as far as I can tell, they're correlating their own data with their own data. This magical "mark" 
they stamp on the prober is unlikely to be more than something like a dummy username & password combination that gets 
stored in their database. When their IDS module sees a packet come in bearing this dummy data they can detect it 
regardless of its source IP. I must be missing something if they're serious when they claim to be able to detect a 
"mark" returning without examining the payload of the packets.

If I'm wrong, please elucidate.

Happy Holidays to All,

Matt

Matt McGuirl                                
Software Support Engineer             
Lucid Security Corporation            
Email: mmcguirl () lucidsecurity com

Attachment: Matt McGuirl.vcf
Description: Matt McGuirl.vcf