RE: IDS testing tools



Aaron,

Just to let you know Traffic IQ Pro www.karalon.com now has over 1000 pcap
files in the product and a single perpetual license is only $4,800, not bad
value when you consider that it includes a CLI, full packet editor and lots
of other capabilties and all of the files are of the highest quality.

Best
Tony

-----Original Message-----
From: listbounce@xxxxxxxxxxxxxxxxx [mailto:listbounce@xxxxxxxxxxxxxxxxx] On
Behalf Of Aaron Turner
Sent: 14 September 2006 20:36
To: focus-ids@xxxxxxxxxxxxxxxxx
Subject: Re: IDS testing tools

On 9/14/06, Akira Matsuno <catchb0dhi@xxxxxxxxx> wrote:

Is nidsbench still a good tool to use , or is it significantly out of date
now?

Well nidsbench is usually considered a suite of tools:

- Fragroute/Fragrouter - Quite amazing how many IDS/IPS's still have
problems with this, especially at higher rates or under load. Neither in
active development AFAIK.

- Tcpreplay - Still in active development
(http://tcpreplay.synfin.net/) and very useful if you have relevant pcap's
to play with. If you don't already have good pcaps, you'll probably have a
hard time finding quality ones which have already been vetted. Maybe one
day http://openpacket.blogspot.com/ or some other service will actually
launch.

--
Aaron Turner
http://synfin.net/

------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from CORE
IMPACT.
Go to
http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=in
tro_sfw
to learn more.
------------------------------------------------------------------------

------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw
to learn more.
------------------------------------------------------------------------