IDS mailing list archives
Re: Snort and Nessus Signature
From: Olaf Gellert <og () pre-secure de>
Date: Fri, 23 Sep 2005 10:05:00 +0200
Ron Gula wrote:
Continuous scanning will help you find some things, but won't find: - new client software - hosts protected by personal firewalls - off-port services (you want to do continuous scanning for all 65k ports?)
Well, you are thinking of scanning as a network related process (a la NMAP), I guess. But there a many other possibilities of scanning: Scanning your local logfiles (eg host based sensors), scanning your local filesystem, scanning your local installation database for new software. This way you may get much more (and very accurate) information than by actively scanning the network (or by analyzing the traffic). Sure this is not as easily deployed as a single network sensor, but it can very well be worth the effort. Cheers, Olaf -- Dipl.Inform. Olaf Gellert PRESECURE (R) Senior Researcher, Consulting GmbH Phone: (+49) 0700 / PRESECURE og () pre-secure de A daily view on Internet Attacks https://www.ecsirt.net/sensornet ------------------------------------------------------------------------ Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more. ------------------------------------------------------------------------
Current thread:
- Snort and Nessus Signature cruxiezzzzz (Sep 16)
- Re: Snort and Nessus Signature Jason (Sep 19)
- Re: Snort and Nessus Signature Vikram Phatak (Sep 19)
- Re: Snort and Nessus Signature Michael Sierchio (Sep 21)
- Re: Snort and Nessus Signature Ron Gula (Sep 22)
- Re: Snort and Nessus Signature Olaf Gellert (Sep 26)
- Re: Snort and Nessus Signature Ron Gula (Sep 26)
- Re: Snort and Nessus Signature Michael Sierchio (Sep 21)
- Re: Snort and Nessus Signature Jason (Sep 26)
- Re: Snort and Nessus Signature Vikram Phatak (Sep 26)
- Re: Snort and Nessus Signature Jason (Sep 26)
- Re: Snort and Nessus Signature Vikram Phatak (Sep 26)
- <Possible follow-ups>
- Re: Snort and Nessus Signature barcajax (Sep 16)
- RE: Snort and Nessus Signature Derick Anderson (Sep 16)