Re: Assessment tools/Scanners

[rgula () network-defense com (Ron Gula)]

> All IDS products are developed with internal test suites that determine
> whether or not a given IDS signature works.  If you are potentially making a
> serious investment in an IDS (volume licenses are not cheap), you should
> justifiably be able to ask each vendor for their internal test suite to
> compare against each IDS.  If you are a low volume buyer, this probably
> won't work for you as producers will be reluctant to release internal test
> tools.

As a vendor, I am not comfortable releasing our test suite of tools. Instead,
we maintain logs of network attacks that we have collected with Dragon from
places like DEFCON and SANS ID-Net. These logs may be trivially converted to
TCPDUMP format for network replay. This technique is much simpler than a suite
of tools because now the customer doesn't have to find an SGI box, a Solaris 
box or whatever else hardware is needed to run the suite. 

Ron Gula
Network Security Wizards