Re: Signatures taking down network

[Ramon Kagan <rkagan () yorku ca>]

Greetings,

Tippingpoint sent out a release on Friday of an error in TOS causing the 
devices to cease and crash.  You may want to download the newest version 
of TOS to correct the problem.

Ramon Kagan, GCIA
Acting Manager, Information Security
Computing and Network Services
York University, Toronto, Canada

-----------------------------------   ------------------------------------
I have not failed.  I have just        I don't know the secret to success,
found 10,000 ways that don't work.     but the secret to failure is
                                       trying to please everybody.
        - Thomas Edison                         - Bill Cosby
-----------------------------------   ------------------------------------

On Sat, 14 Jan 2006, David Williams wrote:

> I'm evaluating a Tipping Point box and after gettting the latest
> signatures I'm having problems with the box "crashing".  My goal is
> not to bash Tipping Point, but instead to gather information on how
> often people have seen this type of thing among IPS boxes.
>
> Is there a trend with vendors to roll out signatures as fast as
> possible without proper QA?  This brings up a lot of questions about
> deploying IPS.  I want two opposite things from my vendors:  1) I want
> the latest signatures super fast.  2)  I want proper QA so that it
> doesn't bring down my network.  I realize those two things are
> contradictory, but I thought I'd throw it out there to see if anybody
> had any thoughts.
>
> thanks,
>
> d
>
> ------------------------------------------------------------------------
> Test Your IDS
>
> Is your IDS deployed correctly?
> Find out quickly and easily by testing it
> with real-world attacks from CORE IMPACT.
> Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
> to learn more.
> ------------------------------------------------------------------------

------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
------------------------------------------------------------------------