RE: Active response... some thoughts.

ummmm, just a technical quibble, but a TCP reset wouldn't work with the Sapphire worm because it propagates using UDP as transport, not TCP.....

Frederick Garbrecht, M.D., GSEC
Coalition of National Cancer Cooperative Groups

-----Original Message-----
From: Kohlenberg, Toby [mailto:toby.kohlenberg@intel.com] Sent: Monday, January 27, 2003 8:27 PM
To: mb_lima; RLos@enteredge.com
Cc: detmar.liesen@lds.nrw.de; abegetchell@qx.net; focus-ids@securityfocus.com
Subject: RE: Active response... some thoughts.

> -----Original Message-----

Actually, TCP resets don't work in many cases- for instance any situation where you have a single packet exploit (say the Saphire worm that just ran through the Net)... This is the same problem that router/firewall reconfiguration has- by the time the response happens, the compromise is done.

toby Received on Tue Jan 28 11:52:43 2003