Security Incidents mailing list archives
Re: cuebot-d infection method
From: Jose Nazario <jose () monkey org>
Date: Mon, 29 Aug 2005 15:07:54 -0400 (EDT)
On Fri, 26 Aug 2005, Jeff Bryner wrote:
This can be misleading, however because internal flow data will capture the outgoing attack packets that may get blocked later by a firewall.
so your firewall is not your flow generation device, ok.
There also doesn't seem to be a one to one correspondence between the flow and what the firewall blocked outgoing. (i.e., the firewall records more blocks than the flow data shows ). Does someone with more flow-data/flow-tools experience know why this may be so?
a couple of possibilities come to mind: are they perhaps getting aggregated by the flow creation device (ie multiple packets per PDU in the flow packet?) is there any sampling going on? you didn't say what kind of flow generation device it was (cisco (and what engine, what breed of hardware), juniper, etc), so it could be also be a device problem ie known quirk, configuration issue, etc). turns out flow is a bit trickier than it appears at first. hope this helps you diagnose the issues. ________ jose nazario, ph.d. jose () monkey org http://monkey.org/~jose/ http://infosecdaily.net/ http://www.wormblog.com/
Current thread:
- cuebot-d infection method Jeff Bryner (Aug 24)
- RE: cuebot-d infection method Matthew Neeley (Aug 24)
- Re: cuebot-d infection method Matt Stockdale (Aug 24)
- Re: cuebot-d infection method Irwan Ismail (Aug 25)
- RE: cuebot-d infection method Jason Burton (Aug 25)
- Re: cuebot-d infection method Jayson Anderson (Aug 25)
- Re: cuebot-d infection method Harlan Carvey (Aug 26)
- Re: cuebot-d infection method Jeff Bryner (Aug 29)
- Re: cuebot-d infection method Harlan Carvey (Aug 29)
- Re: cuebot-d infection method Jayson Anderson (Aug 29)
- Re: cuebot-d infection method Jose Nazario (Aug 29)
- Re: cuebot-d infection method Irwan Ismail (Aug 25)
- Re: cuebot-d infection method Jeff Bryner (Aug 25)
- Re: cuebot-d infection method Simon Borduas (Aug 29)