Re: cuebot-d infection method

[Jose Nazario <jose@xxxxxxxxxx>]

On Fri, 26 Aug 2005, Jeff Bryner wrote:

> This can be misleading, however because internal flow data will capture
> the outgoing attack packets that may get blocked later by a firewall.

so your firewall is not your flow generation device, ok.

> There also doesn't seem to be a one to one correspondence between the
> flow and what the firewall blocked outgoing. (i.e., the firewall records
> more blocks than the flow data shows ).
>
> Does someone with more flow-data/flow-tools experience know why this
> may be so?

a couple of possibilities come to mind:

	are they perhaps getting aggregated by the flow creation device
	(ie multiple packets per PDU in the flow packet?)

	is there any sampling going on?

you didn't say what kind of flow generation device it was (cisco (and what
engine, what breed of hardware), juniper, etc), so it could be also be a
device problem ie known quirk, configuration issue, etc).

turns out flow is a bit trickier than it appears at first.

hope this helps you diagnose the issues.

________
jose nazario, ph.d.			jose@xxxxxxxxxx
http://monkey.org/~jose/ 		http://infosecdaily.net/
					http://www.wormblog.com/