RE: RE: NFR DDOS problems

[Justin.Linton () guardent com]

Archive: http://msgs.securepoint.com/ids
FAQ IDS: http://www.sans.org/newlook/resources/IDFAQ/ID_FAQ.htm
FAQ NIDS: http://www.ticm.com/kb/faq/idsfaq.html
IDS: http://www-rnks.informatik.tu-cottbus.de/~sobirey/ids.html
HELP: Having problems... email questions to ids-owner () uow edu au
NOTE: Remove this section from reply msgs otherwise the msg will bounce.
SPAM: DO NOT send unsolicted mail to this list.
UNSUBSCRIBE: email "unsubscribe ids" to majordomo () uow edu au
-----------------------------------------------------------------------------
Hello:

   Stick uses a snort rule base to create the attack but you could customize
the rule base so that it is common to IDS filters across different vendors
ie. the back orifice filter and other filters that almost all IDS have.

Take a look at this url.

http://www.eurocompton.net/stick/


Justin

> -----Original Message-----
> From: Jeff Nathan [mailto:jeff () wwti com]
> Sent: May 10, 2001 3:51 PM
> To: Justin.Linton () guardent com
> Cc: JStClair () vredenburg com; ids () uow edu au
> Subject: Re: IDS: RE: NFR DDOS problems
>
>
> I'm a bit curious if this will even work against NFR as the intial
> implementaion was simply designed to attack snort's alerting mechanism
> and non-statefulness.
>
> Have you tested NFR with stick?
>
>
> Justin.Linton () guardent com wrote:
> > Archive: http://msgs.securepoint.com/ids
> > FAQ IDS: http://www.sans.org/newlook/resources/IDFAQ/ID_FAQ.htm
> > FAQ NIDS: http://www.ticm.com/kb/faq/idsfaq.html
> > IDS: http://www-rnks.informatik.tu-cottbus.de/~sobirey/ids.html
> > HELP: Having problems... email questions to ids-owner () uow edu au
> > NOTE: Remove this section from reply msgs otherwise the msg 
> will bounce.
> > SPAM: DO NOT send unsolicted mail to this list.
> > UNSUBSCRIBE: email "unsubscribe ids" to majordomo () uow edu au
> --------------------------------------------------------------
> ---------------
> > Hello James:
> >
> >      Do you mean will it start dropping packets if it is DDOSed?
> >
> >      If you want to stress test NFR try Stick against it.
> >
> >      You can get it at securityfocus.com in their tools section.
> >
> > "Stick uses the Snort rule set and produces a C program via 
> lex that when
> > compiled will produce an IP packet capable of triggering 
> that rule from a
> > spoofed IP range (or all possible IP addresses) into a 
> target IP range. A
> > function is produced for each rule and a loop then executes 
> these rules in a
> > random order. The tool currently produces these at about 
> 250 alarms per
> > second." Security Focus Web site.
> >
> >     Of course this would depend on the n-code you have 
> enabled and how you
> > have it set to alert.
> >
> > Best Regards,
> > Justin Linton
> > Security Consultant
> > ____________________________________________
> > G U A R D E N T  C A N A D A
> >   Security | Privacy | Data Protection
> >
> > > -----Original Message-----
> > > From: St. Clair, James [mailto:JStClair () vredenburg com]
> > > Sent: May 8, 2001 2:11 PM
> > > To: 'ids () uow edu au'
> > > Subject: IDS: NFR DDOS problems
> >
> > > Any one hear of potential DDO problems with NFR, in particular
> > > stacheldracht? Appreciate any feedback..
> > >
> > > Jim
>
> -- 
> http://jeff.wwti.com          (pgp key available)
> "Common sense is the collection of prejudices acquired by age 
> eighteen."
> - Albert Einstein