RE: Active response... some thoughts.

I am having a hard time imagining a decent hacker who is allowing inbound and unsolicited ICMP. Furthermore, if a hacker can be assumed to be capable of potentially ignoring RSTs (using a hacked stack), I cannot imagine how ignoring the ICMP would be anything but trivial. Also, this goes back to them being able to determine the presence of active response IDS, as they probably already know that the host/port exists...and even if not, what happens when they get the "port unreachable" AND the valid response from the port?

> -----Original Message-----
> From: Sangram [mailto:sangram@mahindrabt.com]
> Sent: Tuesday, January 28, 2003 11:02 PM
Received on Fri Jan 31 11:36:55 2003