Collaborate Disseminate
Implying I were to use port mirroring, would it increase my network’s jitter/ping and other networking matters?
I’m using a local DNS server/forwarder, would it cause any issues?
Continue reading Do IDS/IPS/HIDS slow your network down? [migrated]
I know that port scanning can set off IDS systems on certain networks due to the suspicious traffic it generates. Can the usage of Wireshark be detected on a network? If so, will using it set off any alert systems, and can it be traced bac… Continue reading Can the usage of Wireshark be detected when sniffing for packets in promiscuous mode? [duplicate]
I have a partner that is asking "Do you use breach detection/prevention tools?".
I host my service on managed hosting (Heroku) and currently migrating to Google Cloud. Should I be using "breach detection/prevention tools&quo… Continue reading Are IDS/IPS already implemented on Google Cloud?
I’m in my last year of university and for my honour’s project I am tasked with comparing two intrusion detection systems, snort and suricata, hosted on a virtual machine on my PC.
As I have no access to networking devices such as switches … Continue reading What is the best way to create a PCAP file containing malicious traffic?
I`m trying to execute YAIDS (installed on ubuntu with quickinstall script) regarding to the general documentation usage in order to analyse a malicious pcap file with the standard ruleset of index.yar from the official rules-master reposit… Continue reading YAIDS execution error without further error log information
How do you figure out Snort’s source & destination IP and port if the question is so vague? For example:
Write a snort rule that detects a UK NI number sent from a client’s web browser to a web server.
I understand how to write the reg… Continue reading How to determine Snort rules source & destination IP and port
I can’t figure it out / understand. Need to write a rule that catches an HTTP POST request from one ip address more than three times in 10 seconds and logs it.
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"HTTP post packet fl… Continue reading suricata http rule to identify POST requests
When someone tries to exploit a vulnerability either by sending traffic to the device directly or by making users click on malicious attachments, drive by exploits or other ways, is it possible you miss the initial attack vector even when … Continue reading Can you hide the initial exploit despite complete visibility into the network traffic?
Can an IDS/IPS work simultaneously with signature-based policy and anomaly-based policy?
Searches about methods used to bypass IPS/IDS, show only results about NIDS and NIPS: obfuscation, encryption, fragmentation but what about HIDS and H… Continue reading Some questions about IDS/IPS
Adam always reads his e-mails on Sundays around 5 pm. This Saturday,
at 11 am, he accessed his inbox. Which will generate a false positive?
Source slide 10/41
Misuse-based IDS or anomaly-based IDS? IMO the answer should be anomaly-based … Continue reading Misuse vs anomaly detection alerts