RE: Signatures taking down network

We've been running a TippingPoint IPS for over a year now without a single
failure of any kind. However, when we first installed the box it ran a few
hours and died immediately after installing the latest signatures. I
restarted it and once again it ran a few hours and died. We had temporarily
connected the management interface to one of the same network segments it was
protecting so I went ahead and setup an isolated management network and
connected the management interface there and it ran without problems. Just to
be sure that was the problem, I connected the management interface back to a
protected segment and once again it died after a few hours. With the
management interface connected to an isolated network it has never failed. I
load the signatures as soon as possible after receiving notice and have never
experienced a problem from them.

Larry Craddock


-----Original Message-----
From: David Williams [mailto:dwilliamsd@xxxxxxxxx]
Sent: Saturday, January 14, 2006 8:04 AM
To: focus-ids@xxxxxxxxxxxxxxxxx
Subject: Signatures taking down network

I'm evaluating a Tipping Point box and after gettting the latest signatures
I'm having problems with the box "crashing". My goal is not to bash Tipping
Point, but instead to gather information on how often people have seen this
type of thing among IPS boxes.

Is there a trend with vendors to roll out signatures as fast as possible
without proper QA? This brings up a lot of questions about deploying IPS. I
want two opposite things from my vendors: 1) I want the latest signatures
super fast. 2) I want proper QA so that it doesn't bring down my network.
I realize those two things are contradictory, but I thought I'd throw it out
there to see if anybody had any thoughts.

thanks,

d

------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from CORE
IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
------------------------------------------------------------------------


------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
------------------------------------------------------------------------

Relevant Pages

  • Re: Signatures taking down network
    ... signatures were created in that release. ... Vendor might have used different test environment ... the signature pack by configuring a dummy network on ... IPS vendor. ...
    (Focus-IDS)
  • Re: 10Gbps IPS - what you need to know
    ... security-centric IPS devices from the performance-centric IPS devices. ... that tout performance often have aggressive algorithms for moving packets to ... There are intelligent ways to minimize the applied set of signatures ... the vendors do not set out to cheat on the tests. ...
    (Focus-IDS)
  • Re: ROI on IDS/IPS products
    ... since an IPS is nothing more than an IDS that can drop traffic;-) ... By purchasing an IPS from a vendor and enabling even *some* of the signatures for blocking I have established that I trust my vendor and I trust the signature authors to write signatures that are good enough to block an exploit or an attempt to exploit a vulnerability. ...
    (Focus-IDS)
  • Re: 10Gbps IPS - what you need to know
    ... IPS devices have a 'fast path' or 'push-through' or similarly named ... security-centric IPS devices from the performance-centric IPS devices. ... that tout performance often have aggressive algorithms for moving packets to ... There are intelligent ways to minimize the applied set of signatures ...
    (Focus-IDS)
  • [NEWS] Cisco IPS MC Malformed Configuration Download Vulnerability
    ... An issue exists in one of the components of the Cisco Management Center ... for IPS Sensors v2.1 during the generation of the Cisco IOS IPS ... each packet to match any of the Cisco IOS IPS signatures that have been ...
    (Securiteam)