[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[ISSForum] ARP Pisoning, etc.
1. ARP Poisoning can be used for sniffing in switched network. As I
understand (please, correct me if I'm wrong) the only way for Network
sensor to detect ARP poisoning is signature IP_Duplicate, which detects
two or more computers on network using the same IP address. IP_Duplicate
has a lot of false positives because of clusters (server clusters,
router cluster with HSRP, etc) and it's no ability to tune this
signature with event filters, because its impossible to create filters
for event details (because different MACs of IP are specified in event
details). Most of IP_Duplicate events in my environment are FP. Does the
only way for me is to supply enhancements request to ISS to realize the
ability to create filters for event details? Unfortunately, I think,
this can't be done soon. Does someone have ideas about ARP Poisoning
detection? ANY feedback will be welcome.
2. Another question addressed to someone from ISS. There is a very
useful event - SensorStatistics. It can be used for behavior based
(statistical) analysis. I can do this by hand (for example, by SEC.pl I
can store statistics in database, and analyze delta), but may be ISS
plan this analysis in future?? Should I supply enhancements request for
this need too?
Best regards, Sergey V. Soldatov.
Information security department.
tel/fax +7 095 745 89 50
tel +7 095 777 77 07 (1613)
ISSForum mailing list
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum
To contact the ISSForum Moderator, send email to mod-issforum@xxxxxxx
The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.