Home page logo

pen-test logo Penetration Testing mailing list archives

Re: IDS Assessments....and the I{D|P}S evasion research project
From: "Eric Hacker" <my.self () erichacker com>
Date: Fri, 17 Nov 2006 09:01:27 -0500

To help us automate the correlation, we bound each individual test
case to a unique source port, and included the source port in the file
name. (Well, we used N for 9, because the exploit couldn't write a 9,
but you get the idea).  So that way we knew that for a given suite of
tests, source port 30000 was test X.

Even if you can't do the rest of it, keying each test case to a source
port is an enormous help in correlation.

Yes, correlation is important and a very good idea. I forgot about that.

Wherever possible use things like source port, IP ID, TCP seq numbers,
etc. to discriminate attacks and allow easier correlation. I've set
the IP ID field to the Snort ID in some testing. Even though it didn't
end up being used for correlation in the end, it helps in debugging
when reading packet traces.

Eric Hacker, CISSP

aptronym (AP-troh-NIM) noun
A name that is especially suited to the profession of its owner

I _can_ leave well enough alone, but my criteria for well enough is
pretty darn high.

This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]