Re: Bypassing "smart" IDSes with misdirected frames? (long and boring)

[Michal Melewski <mike () pn66 poznan sdi tpnet pl>]

Hello
> From what i know you haven't discovered anything new. The problem regarding
false MAC adressing was discused in "Eluding ID systems..." from 1998.
I admit, that your aproach is more spohisticated and simple "drop all wrong
MAC adresses" wouldn't help. In my opinion solution like MAC adress based
session reasemblance can help.
Generaly IDSes should move into nearly VM that behave like system being under
attack but in isolated enviroment and assesing all impacts. This, however is
SF for now.

(this is short version or my response because i'm in work now, extended
version comming out soon)

-- 
Michael "carstein" Melewski      |  "Humanistą był Kepler, był Liebnitz.
carstein () poznan linux org pl          |   Człowiek definiujący humanizm jako
mobile: 502 545 913              |   brak umiejętności całkowania
gpg: carstein.c.pl/carstein.txt  |   humanistą nie jest."

---------------------------------------------------------------------------

---------------------------------------------------------------------------