Re: Session Vs Packet Switching
From: Drew (simonis@myself.com)Date: 06/03/02
- Previous message: Ian P. Christian: "RE: Normalizers, OpenBSD, etc."
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Mon, 03 Jun 2002 12:05:15 -0400 From: Drew <simonis@myself.com> To: focus-ids@securityfocus.com
"Gustavo Ossandon S." wrote:
> This is an open question
>
> New technologies are implementing session switching over the old
Packet
> switching algorithms
>
> This means just the first packet of a session gonna be
> inspected and all the
> rest of the session will be granted pass .....
>
You speak of multi-layer switching (MLS). Not strictly "new", and not
really related to IDS. Keep in mind that there are several types
of flow masks associated with MLS, and they do support the addition
of security, in the form of standard and extended ACLs on the MSL-RP
(Cisco as a reference point here).
> What security implications this would carry ???
>
> What possibility exist, that some hacker could penetrate under a
session
> already stablished ???
>
(...)
Basically, this is a performance solution, not a security solution.
Can you spoof a packet that would be part of an MLS flow? I dunno.
Would such a spoofed packet be allowed to pass regardles of MLS?
Yes.
>
> Maybe these are relly good questions to discuss :-)
>
Maybe in a different group?
- Previous message: Ian P. Christian: "RE: Normalizers, OpenBSD, etc."
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
