Re: [Moderator FWD] Re: BlackICE IDS

[dugsong () monkey org (Dug Song)]

On Wed, 8 Dec 1999, Martin Roesch wrote:

> A better solution is to use Dug Song's tcpreplay to retransmit the
> packet traffic files directly onto the network at a selectable speed, so
> that you get a "Real World" test of the performance while reading data
> through the NIC.

tcpreplay is indeed an excellent tool for this, as you can sample local
traffic and replay the same sample against different IDSs for comparative
testing. the traffic shaping options should be used carefully, though -
they were only included to implement a poor man's load generator.

also, credit where credit's due: Matt Undy <mundy () anzen com> wrote
tcpreplay, not me. :-)

-d.

http://www.monkey.org/~dugsong/