RE: IDS responses

This is a good list but you missed one:
forged response to the attacker- Dragon has/had (I haven't checked to see if it is in the newest release) the ability to respond to things like scanning and Nmap OS detection packets with spoofed data that would suggest a different OS or ports being open/closed when they are not in reality. This is very cool, IMHO, as it doesn't kill the connection, it just injects some false information into the data flow that will make the attackers job more difficult.

All opinions are my own and in no way reflect the views of my employer.

Toby

> -----Original Message-----
> From: marca369@student.liu.se [mailto:marca369@student.liu.se]
> Sent: Friday, November 15, 2002 5:06 AM
> To: focus-ids@securityfocus.com
> Subject: IDS responses
>
>
>
>
> Hi all!
Received on Fri Nov 22 19:13:06 2002