From: Clemens, Dan (Dan.Clemens@healthsouth.com)
Date: Tue Aug 29 2006 - 14:33:14 EDT
Chris,
Generally you need packet captures to validate what alarms you are
seeing on your ids, or if you need to troubleshoot a problem.
In other cases you may need to have recorded network sessions/data to
use as elements in some sort of internal investigation or validation
that information did get leaked from your network.
All in all tell them it's a necessary tool to validate other alarms.
You could put together a small bsd box that simply performs tcpdumps on
your desired network segment all day long and not pay for some other
commercial system that gives you a nice gui.
-Daniel Clemens
-----Original Message-----
From: xelerated [mailto:xelerated@gmail.com]
Sent: Tuesday, August 29, 2006 8:32 AM
To: pen-test@securityfocus.com
Subject: Packet Payload
Im posrting this to the pen-test group, rather than firewall or IDS
because it covers many areas.
Id like to see what the pro's think about capturing and storing packet
payloads from firewalls, ids, etc... everything rather than just loggin
the incidents.
Im trying to explain to my management how useful the payloads could be
if we were ever to really need them, say from a forensics point of view.
To give another example, one time I was seeing lots of firewall drops, I
could tell what ports, src and dest. but no packet data. To everyone
involved it looked like a worm trying to spread.
Well in the end it wasnt, infact is was something that was nice to know
about, but it was not hostile traffic. But if I had been able to see the
payloads i could have seen the data request and known from the start
what it was, or was not.
What would be really great, is a whitepaper covering this, or enough
info/facts that I could throw one together.
thanks!
Chris
C|EH, CISSP
------------------------------------------------------------------------
This List Sponsored by: Cenzic
Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php
------------------------------------------------------------------------
-----------------------------------------
Confidentiality Notice: This e-mail communication and any
attachments may contain confidential and privileged information for
the use of the designated recipients named above. If you are not
the intended recipient, you are hereby notified that you have
received this communication in error and that any review,
disclosure, dissemination, distribution or copying of it or its
contents is prohibited. If you have received this communication in
error, please notify me immediately by replying to this message and
deleting it from your computer. Thank you.
------------------------------------------------------------------------
This List Sponsored by: Cenzic
Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php
------------------------------------------------------------------------
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:56:52 EDT