Intrusion Detection Systems: Re: DEFCON packet collection? (Dragon at DEFCON)

[Ron Gula <rgula () network-defense com>]

Archive: http://msgs.securepoint.com/ids
FAQ: http://www.ticm.com/kb/faq/idsfaq.html
IDS: http://www-rnks.informatik.tu-cottbus.de/~sobirey/ids.html
HELP: Having problems... email questions to ids-owner () uow edu au
NOTE: Remove this section from reply msgs otherwise the msg will bounce.
SPAM: DO NOT send unsolicted mail to this list.
UNSUBSCRIBE: email "unsubscribe ids" to majordomo () uow edu au
-----------------------------------------------------------------------------
Hi all,

We will be running Dragon Sensor at the CTF network this year. We may
also run some Dragon Squire HIDS on some of the target systems if 
folks are interested. Logs will be posted as soon as we can get them 
uploaded. Last year we spent a lot of time answering questions about 
IDS, and we hope to do the same this year. Hopefully, someone will 
crack root remotely on a box earlier than last year. Last year we had
things like 100's of simultaneous nmap scans, some proprietary commercial
scanners, a few zero days, lots of people trying to compile gtk to get
nessus working and all sorts of TCP sniping to keep folks off of SSH ... 

For those who have not heard of CTF or DEFCON, check out www.defcon.org

Also, the anti-ids talk I gave at HOPE 2000 is available at 
http://www.securitywizards.com/papers/ron_gula-blackhat.zip
It is the same one I am giving at Blackhat if you are not in attendance.

Ron Gula
Network Security Wizards