IDS: Re: Snort signature packet generator: Thanks

["Aaron" <microchp () microchp org>]

One more for your list:  http://www.nessus.org/



On Mon, 08 Nov 2004 13:45:00 -0500
 Graeme Connell <gconnell () middlebury edu> wrote:
> To all who sent me links to programs generating packets 
> from snort signatures:  Thanks a bunch.  I've got more 
> than enough programs to start myself off with now.  For 
> those of you with the same question as me, here's a 
> rundown of what I've received:
> <blatant copy-paste>
>
> Snot: http://www.stolenshoes.net/sniph/index.html
>
> Stick: http://www.eurocompton.net/stick/projects8.html
>          http://www.securityfocus.com/tools/1974
>
> Blade's IDS Informer: 
> http://www.blade-software.com/IDSInformer.htm
> FPG: http://www.geschke-online.de/FLoP/
>
> Nemesis: http://nemesis.sourceforge.net/
>
> Sneeze: http://www.securiteam.com/tools/5DP0T0AB5G.html
>
> Mucus: http://www.cs.ucsb.edu/%7Ersg/Mucus/index.html
>
> </blatant copy-paste>
>
> Some comments:
> I'm not sure if Blade Software's IDS Informer 30-day 
> trial liscence will allow me to use it for research 
> purposes.  I've contacted them and am waiting for a 
> response.
> As for using Nemisis / Nmap, the problem is that I'm 
> looking to generate very large data sets, and crafting 
> each packet with nemesis would take me the rest of my 
> life.  Nmap is a bit too specialized (scanning only).
> By the way, I've been trying to download Shmoo Group's 
> Capture the Root-Fu (http://www.shmoo.com/cctf/) to use 
> for the same purpose, but as of yet I'm unable to 
> download through either the Bittorrent or the Http link. 
> Does anyone have this packet dump mirrored anywhere?  Or 
> sitting at home collecting dust on a CD?
> Once again, thanks for all the help.
>
>                 --Graeme
>
> --------------------------------------------------------------------------
> Test Your IDS
>
> Is your IDS deployed correctly?
> Find out quickly and easily by testing it with real-world 
> attacks from CORE IMPACT.
> Go to 
> http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
> to learn more.
> --------------------------------------------------------------------------

--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from 
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
--------------------------------------------------------------------------