IDS mailing list archives
Re: Local Mirror Prevention with IDS
From: mike () pn66 poznan sdi tpnet pl (Michal Melewski)
Date: Mon, 20 Dec 2004 20:39:52 +0100
On Fri, Dec 17, 2004 at 02:38:16PM +0200, Dimitrios Patsos wrote:
Hi! Can anybody provide some help on how can we prevent a user from making a local mirror of a web site by using both host & network IDS?
If it isn't diffrent from normal HTTP traffic it's impossible to do it by NIDS. (Quoting someone from this list - "There is not enough information on a wire."). By HBIDS? Like using hammer to splash a fly. Try restrict using programms like wget (or write some wrapper to catch '-r' and '-l" options). You can always use quota if it's the lack of free space problem or some bandwidth management if having problems with bandwith consumption.
Thank you in advance. Regards, Dimitrios G. Patsos IT Security Consultant
Best regars -- Michael "carstein" Melewski | "Humanistą był Kepler, był Leibnitz. carstein () poznan linux org pl | Człowiek definiujący humanizm jako mobile: 502 545 913 | brak umiejętności całkowania gpg: carstein.c.pl/carstein.txt | humanistą nie jest." -------------------------------------------------------------------------- Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more. --------------------------------------------------------------------------
Current thread:
- Local Mirror Prevention with IDS Dimitrios Patsos (Dec 20)
- Re: Local Mirror Prevention with IDS Michal Melewski (Dec 23)
- Re: Local Mirror Prevention with IDS Kevin Johnson (Dec 23)
- Re: Local Mirror Prevention with IDS Kevin (Dec 23)
- Re: Local Mirror Prevention with IDS Michael Boman (Dec 23)
- Re: Local Mirror Prevention with IDS Jason (Dec 27)
- Re: Local Mirror Prevention with IDS Kyle Maxwell (Dec 23)