RE: Active response... some thoughts.

From: Brian Laing <Brian.Laing(at)blade-software.com>
Date: Fri Jan 31 2003 - 14:56:17 EST

Keep in mind its not just the sensor, its also the network. If the sensors is on the perimeter and the target is a decent way into the network normal network delay would with a high degree of probability prevent the reset getting there in time

Blade Software Nominated In The 8th ANNUAL SC AWARDS click on http://www.scmagazine.com/awards to vote

---

---

Brian Laing
CTO
Blade Software
Cellphone: +1 650.280.2389
Telephone: +1 650 367.9376
eFax: +1 208.575.1374
Blade Software - Because Real Attacks Hurt http://www.Blade-Software.com

---

-----Original Message-----
From: mb_lima [mailto:mb_lima@uol.com.br] Sent: Friday, January 31, 2003 8:35 AM
To: b_paul_palmer@yahoo.com
Cc: focus-ids@securityfocus.com
Subject: Re: Active response... some thoughts.

 Hi Paul,

  It is perfect your explanation, but an attacker can create ways to keep a sensor busy enough so that "if the sensor is fast enough" is not true. But I agree with you. TCP RST works fine for me. Best Regards,

  Marcelo

> Actually, TCP RST is more than just a marketing
 

---
UOL, o melhor da Internet
http://www.uol.com.br/

Received on Mon Feb 3 10:57:57 2003