Snort mailing list archives
RE: block connections in IPS]
From: Geoff <gpoer () arizona edu>
Date: Thu, 02 Oct 2003 08:56:33 -0700
OOO now we are getting heated :) While Flex-Response may not be reliable in snort... (which I may argue but not today) active response features are available in "other" IDSs and can provide protection from attacks that a firewall would never see. Granted a good application firewall may do the job. But on a fast link with lots of sessions an application firewall can not keep up with the session establishment rate (20kps @ our university).I can't remember how many Resets get sent out when the Flex_RESP piece is being used. However, other vendors send 100 resets in each direction in an effort to spoof the correct sequence number. Lots of small (usually fragmented) packets can easily generate 100 packets before the reset reaches the remote host however it is much harder to beat the resets headed toward the local host. It's a race condition on both sides of the connection but your local network is usually faster than the Internet. Tearing down the local connection (internal network) but not the remote connection some say is a feature but that is also a debate for another email :)
The ability to dynamically write an ACL also gives you some leeway in the realm of firewall over head. Assuming you are not shunning on your firewall and decide to shun on your routers that are upstream of your FW you can provide protection for your firewall. When attacks like Slammer and even Code Red hit they generated traffic and a lot of sessions. The firewall (without some tunning provided ) did nothing to stop it. However, we had signatures for code red long before it came out. Setting those to shun and shunning in front of the firewall slowed down the infection/attack rates. Granted with shunning we typically see 5-10 packets get through before an ACL is applied (higher CPU load on routers drives that number up fast) but slowing down those attacks was enough to give us some breathing room to get it under control before it took over campus.
Nothing like a good conversation over some coffee :) Geoff -----Original Message----- From: snort-users-admin () lists sourceforge net [mailto:snort-users-admin () lists sourceforge net] On Behalf Of Michael Steele Sent: Wednesday, October 01, 2003 11:51 PM To: 'Geoff'; Snort-users () lists sourceforge net Subject: RE: [Snort-users] block connections in IPS Geoff, Another BIG misconception is the ability of Snort to protect a network using Flex-RESP. It never has been and most likely never will be reliable. Flex-RESP is not a normal part of Snort. You MUST install it as an add-on. If you want a good RELIABLE Flex-RESP type of device, then invest in a good firewall and place it in the appropriate line of fire. Cheers... -Michael Steele -- System Engineer / Security Support Technician mailto:michaels () winsnort com Website: http://www.winsnort.com Snort: Open Source Network IDS - http://www.snort.org -----Original Message----- From: snort-users-admin () lists sourceforge net [mailto:snort-users-admin () lists sourceforge net] On Behalf Of Geoff Sent: Wednesday, October 01, 2003 10:41 PM To: Snort-users () lists sourceforge net Subject: Re: [Snort-users] block connections in IPS I don't think you are correct on what an IPS is. A normal IDS can preform flex-response (in snort land) which send s resets. Active response features like ICMP error codes and shunning (applying dynamic acl's to routered interfaces or firewalls) are also enployed by different IDS vendors. IPS's work in a different fashion. They sit inline with your connection (or they are just an IDS). |---------------| |---------| | | |-----------| | Border |<--->| IPS |<--->| Internal | | Router | | | | Router | |_________| |_______________| |___________| Their is nothing that says on IDS can not sit inline as well however an IPS can ONLY sit in line and IDS can do both and still function. The difference is how far the packet goes after detection. An IPS will drop the packet BEFORE it ever leaves the opposite interface from where it came in on. (X = Bad Packet) |----------------| |---------| X | X | |-----------| | Border |<--->| IPS |<--->| Internal | | Router | |(Packet Dropped)| | Router | |_________| |________________| |___________| Some vendors will also write and ACL on the IN and OUT interfaces of the IPS for the source/destination IP and PORT pairs and block all traffic for a certain time (90 sec). And IDS will send a reset of apply an acl but that is well after the packet has reached it destination. As far as false positives... that is a whole other email :) Geoff Ravi Kumar wrote:
Hi All,IPS uses TCP Reset or ICMP to block connections. The drawback with this approach could be unsuccessful ness in resetting the connection. Do IPS have any other mechanism to block connections.Snort_inline uses TCP reset and ICMP error messages.The other approach currently followed by some products is to configure policies automagically in the firewall to block particular connections. This may lead to many false positives.Is there any mechanism to reduce false positives and effectively block connections.Regards, RaviThe Views Presented in this mail are completely mine. The company is not responsible for what so ever.---------- Ravi Kumar CH Rendezvous On Chip (I) Pvt Ltd Hyderabad, INDIA ROC HOME PAGE: http://www.roc.co.in ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- RE: block connections in IPS] Geoff (Oct 02)
- Re: block connections in IPS] Jeff Nathan (Oct 02)