Re: IDS Assessments....and the I{D|P}S evasion research project

["Eric Hacker" <my.self@erichacker.com>]

> To help us automate the correlation, we bound each individual test
> case to a unique source port, and included the source port in the file
> name. (Well, we used N for 9, because the exploit couldn't write a 9,
> but you get the idea).  So that way we knew that for a given suite of
> tests, source port 30000 was test X.
>
> Even if you can't do the rest of it, keying each test case to a source
> port is an enormous help in correlation.
Yes, correlation is important and a very good idea. I forgot about that.

Wherever possible use things like source port, IP ID, TCP seq numbers,
etc. to discriminate attacks and allow easier correlation. I've set
the IP ID field to the Snort ID in some testing. Even though it didn't
end up being used for correlation in the end, it helps in debugging
when reading packet traces.

--
Eric Hacker, CISSP

aptronym (AP-troh-NIM) noun
A name that is especially suited to the profession of its owner

I _can_ leave well enough alone, but my criteria for well enough is
pretty darn high.

------------------------------------------------------------------------
This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW
------------------------------------------------------------------------