> Most likely what the guy is selling (or trying to sell) is some sort of
> IDS/network system that grabs the problem packets before they get to the
> server's application layer to do damage. Companies like eEye have been doing
> this for a long time - have a predefined "these packets are within our
> tolerances" baseline and then anything that is outside of it gets squished.
> It is actually a good idea (I think) for any machine publicly exposed. You
> define the traffic you are willing to take including request lengths, etc
> for various ports/protocols and anything outside of that gets dropped and an
> error is generated. Maybe it is a new way to access a new app on the box,
> maybe it is a new attack style. Either way if say that HTTP request is
> composed of more than say x bytes, the http daemon never sees it.
Based on the link just posted, this is probably along the lines of what
it is they were trying to sell. I could be wrong, but it still seemed
like this vendor is getting information before the rest of the world.
I think it is a totally lame approach. The patch distribution problem
has been pretty much solved by other vendors. We would all sleep better
at night if M$ would just get a clue. Oh well.
tim
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
Received on Jan 10 2004
Intro
