IDS: Re: Router/Switches and viruses

[Derek Nash <ddnash () gmail com>]

We saw it all the time at the ISP I worked for. A PC would pickup up a
nasty scanning type virus, SQL Slammer comes to mind, and would take
up all the NAT/PAT translation slots on a router/firewall. Routers
running NAT remain susceptible to this vulernability to my knowledge.
Most modern firewalls have source-based session limiting to prevent
this type of DOS.

Lastly I have seen HP Procurve Switches lock up from a port scan. This
is a known issue that has been fixed with a firmware upgrade.

On 5/3/05, Seek Knowledge <aseeker03 () yahoo com> wrote:
> Does anyone have any first-hand experience with a
> single infected desktop machine (or windows server for
> that matter) taking out a LAN switch? Would anyone
> have any stories from the trenches of an infected
> machine causing a directly connected router to stop
> functioning?
>
> If so, what could be done to prevent such an outage?
> What IDS/IPS strategy might one implement to prevent
> and or at least detect such an event?
>
> Thanks in advance.
> ASeeker
>
> ________________________________________________________________________
> Yahoo! Messenger - Communicate instantly..."Ping"
> your friends today! Download Messenger Now
> http://uk.messenger.yahoo.com/download/index.html
>
> --------------------------------------------------------------------------
> Test Your IDS
>
> Is your IDS deployed correctly?
> Find out quickly and easily by testing it with real-world attacks from
> CORE IMPACT.
> Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
> to learn more.
> --------------------------------------------------------------------------

-- 
Derek Nash; CISSP, CCSP, NCSP, MCSE

--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
--------------------------------------------------------------------------