RE: Cisco IDS

["Alex Butcher, ISC/ISYS" <Alex.Butcher () bristol ac uk>]

--On 19 January 2005 09:07 -0500 John Hally <JHally () epnet com> wrote:

> Wow!  Thanks Alex!
>
> The cool thing about Sguil is the ability to pull up a pcap file for the
> particular event reported.

The same can be done quite easily with ACID, if you're using a spool 
processor which respects tagged packets. FLoP, for instance, does this. I 
then wrote a small amount of PHP around the included 'getpacket' utility to 
retrieve all tagged packets that were related to the triggering packet.

The one disadvantage that I've found with using this extensively is that 
your alert database does get quite heavily loaded with 'tagged packet' 
alerts. Given ACID's apparent scalability issues, this is annoying.

> Things like "403 access forbidden" alerts are
> nice, but you never know what the user was looking for or if it's a bad
> link or something unless you can look at the request.  Currently I have
> to be doing packet capture dumps on the traffic and have to manually
> drill down through the files manually, ftp over and then look at them in
> ethereal or something.  With Sguil it's a click away right in the
> analysis interface. This is very cool.

Seconded.

> I'm going to check out snortcenter2 in depth today.  Are your patchsets
> for p0f available somewhere if I may ask?

No, not just yet. :-(

> Thanks!

Best Regards,
Alex.

> -----Original Message-----
> From: Alex Butcher, ISC/ISYS [mailto:Alex.Butcher () bristol ac uk]
> Sent: Wednesday, January 19, 2005 4:02 AM
> To: John Hally; 'Theodore Stout'; 'snort-users () lists sourceforge net'
> Subject: RE: [Snort-users] Cisco IDS
>
> --On 18 January 2005 23:08 -0500 John Hally <JHally () epnet com> wrote:
>
> > That wasn't so bad, I figured I'd get flamed for posing the question :-)
> >
> > Actually, I have no problem building Snort, and have used it since v1.8
> > with good results.  The main problem I have is a couple things.
> >
> > First, no real good mgmt interface.  Snort Center was great, but it's
> > fallen on hard times, and you can't get anything but 2.0 to run on it
> > without doing a lot of php hacking, and I just don't have the time.  For
> > a php developer, I'm sure it can be done, but I'm the biggest hack, so it
> > would take a lot more time for me.
>
> Try Snortcenter2 - <http://sourceforge.net/projects/snortcenter2/>.
>
> > Second, ACID is good, but there's no real correlation/mitigation.
>
> Look into using ACID in conjunction with OS-SIM <http://www.ossim.net/>.
>
> > Sguil looks like it's going to be something, but its just a little
> > young,  and it can be a pain to get working.  I haven't tried BASE,
> > though it looks like it's basically the same thing.
>
> I've diffed BASE against ACID, and I haven't seen enough significant
> changes to make me want to port my local ACID patchset to BASE.
> Eventually,  I'll get round to releasing it, and the BASE guys can pick
> over it for  features if they like.
>
> > I love the idea of RNA.  I've played around with p0f recently, and even
> > at a low level, the idea of passive OS identification is slick.  I'm
> > guessing at some point someone will hack up a version of p0f to attempt
> > to detect applications as well.
>
> Try pads <http://passive.sourceforge.net/>. I ported most of nmap's
> application signatures to pads. I sent them to pad's author and I thought
> he'd put them in the contrib area of the CVS, but I appear to be
> mistaken.  If you limited pads to only reporting on your own network
> (i.e. a /16 or  so), then performance seemed to be OK. I plan on
> integrating pads' results  with ACID eventually. I've already done
> something similar for p0f in my  patchset.
>
> Best Regards,
> Alex.



--
Alex Butcher: Security & Integrity, Personal Computer Systems Group
Information Systems and Computing             GPG Key ID: F9B27DC9
GPG Fingerprint: D62A DD83 A0B8 D174 49C4 2849 832D 6C72 F9B2 7DC9




-------------------------------------------------------
The SF.Net email is sponsored by: Beat the post-holiday blues
Get a FREE limited edition SourceForge.net t-shirt from ThinkGeek.
It's fun and FREE -- well, almost....http://www.thinkgeek.com/sfshirt
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users