Re: Important Comments re: INtrusion Detection

[Vern Paxson <vern () ee lbl gov>]

> Does anybody have stats on how
> often TCP packets just barely make it to the destination?

Lessee:

        tcpdump 'ip[8:1] < 4 and tcp and not port bgp'

Running this on our border DMZ at 11PM on a Friday night (yeah, I know,
don't I have anything better to do? :-) turns up a TCP packet with a TTL
of 1, 2 or 3 on average once every 8 seconds.

> From my experiences with running Bro for close to two years now, I'd say
that false alarms are a *major* headache.  They suck up a lot of energy
figuring out whether they're actually something to worry about; or you get
blase', and now you're vulnerable ...

                Vern