Re: [Full-Disclosure] IDS WIth TCP Reset and SPAN

["dila" <dila@xxxxxxxxxxxxx>]

As far as I know, Snort has no drop capabilities, hence Intrusion
_Detection_ System.

I found this using google:
http://www.mcabee.org/lists/snort-users/Mar-03/msg00379.html

-dila

>Hello Group,
>
>Hopefully, this topic is ok to discuss here. I am fairly new to IDS systems 
>and am having trouble getting my cisco IDS to send TCP resets. The lab network 
>is as follows:
>
>
>               R4
>R1----IDS----|
>               R2------R3
>
>R4 and R2 are on the same ethernet segment. R1 is on Command and Control side 
>of the sensor. The attack is coming from R3 ( telnet to R4 and issue 
>"testattack" string ). The alarm shows up in event viewer...but no tcp 
>reset...I mean...my telnet session stays active. 
>
>I know this probably has something to do with how I am setting up SPAN on the 
>switch....but I am not sure. The IDS Sensing interface, R4 and R2 are on the 
>same switch and in VLAN 20. R3 is in VLAN 30.
>
>I have tried it without span ( just R4, R2 and IDS sensing interfaces in same 
>vlan ) and with span configured as follows. Niether has worked.
>
>monitor session 1 source vlan 20 rx
>monitor session 1 destination int f0/17 ingress vlan 20
>
>Any ideas??
>
>Thanks,
>
>Dain

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html