Re: RE: VERY simple 'virtual' honeypot

[Ryan Russell <ryan () securityfocus com>]

On Fri, 8 Mar 2002, Ashley Thomas wrote:
> I would think that it is best if the IDS remains in the stealth mode
> without doing anything "active"

I agree.  Any response allows for fingerprinting, and potentially being
able to identify the IDS.  If I were trying to evade an IDS, the first
thing I would want to know is which one I'm dealing with.

                                        Ryan


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users