RE: IDS Stealth Mode

From: Aditya <aditya(at)online.gr8domain.biz>
Date: Fri Jan 10 2003 - 02:00:34 EST

how does one setup a stealth admin network using linux and win2k using snort and ipchains or any free firewall that comes along with freebsd

please point me to the docs on the subject
-aditya

MAILTO:orwy8001@sneakemail.com

-----Original Message-----

From: r)(o)(m [mailto:nom.de.guerre@bonbon.net] Sent: Wednesday, January 08, 2003 8:10 PM To: focus-ids@securityfocus.com
Subject: IDS Stealth Mode

Retrying this post after 2 days:
A common deployment configuration of Network IDS is to have 2 NICs; Teh monitoring interface in "stealth mode" with no IP and
the "management" interface on a trusted internal network.

My question is:
Has anyone ever exploited the "stealth" interface to traverse networks? Has anyone (else) ever had to defend such a configuration against the argument:
"where there's a wire, there's a way"
?
r)(0)(m

---

Delivered using the Free Personal Edition of Mailtraq (www.mailtraq.com) Received on Sun Jan 12 15:45:54 2003