RE: Packet Payload

Chris

I have been using it from a long time ago.
The main use is to verify what the firewall and IDS logs are trying to tell me.
Although, my first wonderful experience using packet capturing systems (tcpdump with 128 bytes of payload) was when a customer denounced to my employeer (a TELCO) about DNS poisoning.
I worked on network forensics by tracking and reconstructing packet by packet to show to this customers that we never were exploited by a DNS poisoning attack, and our DNS resolved perfectly well.

Javier Romero
GCIA GCSC CISSP
JaCkSecurity.com

-----Mensaje original-----
De: xelerated [mailto:xelerated@xxxxxxxxx]
Enviado el: Martes, 29 de Agosto de 2006 08:32 a.m.
Para: pen-test@xxxxxxxxxxxxxxxxx
Asunto: Packet Payload


Im posrting this to the pen-test group, rather than firewall or IDS
because it covers many areas.

Id like to see what the pro's think about capturing and storing packet
payloads from firewalls, ids, etc... everything rather than just
loggin the incidents.

Im trying to explain to my management how useful the payloads could be
if we were ever to
really need them, say from a forensics point of view.
To give another example, one time I was seeing lots of firewall drops,
I could tell what ports, src and dest. but no packet data. To everyone
involved it looked like a worm trying to spread.
Well in the end it wasnt, infact is was something that was nice to
know about, but it was not hostile traffic. But if I had been able to
see the payloads i could have seen the data request and known from the
start what it was, or was not.

What would be really great, is a whitepaper covering this, or enough
info/facts that I could throw one together.

thanks!
Chris

C|EH, CISSP

------------------------------------------------------------------------
This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php
------------------------------------------------------------------------





------------------------------------------------------------------------
This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php
------------------------------------------------------------------------

Relevant Pages

  • RE: how to block connections running on non-default ports
    ... or Firewall will block the packets as per the rules ... From your scenario it looks like you have a packet filter Firewall.A ... Similar is the case for Inline IDS. ... running telnet server on port 443. ...
    (Security-Basics)
  • Re: Application Layer packet inspection???
    ... packet to IIS causing a buffer overflow. ... the firewall itself: witness the recent attack on Snort: the ... attacker would send packets designed to attack the IDS and not any existing ...
    (comp.security.firewalls)
  • Re: BlackIce (with 3/2002 defs) / Sygate Pro does not detect Nimda
    ... You say no other firewall does this but you are so wrong. ... You can disable everything after the baseline, ... shortage of outbound packet filters. ... Unfortunately the IDS is tied to its shabby firewall which isn't much better ...
    (comp.security.firewalls)
  • Packet Payload
    ... Im posrting this to the pen-test group, rather than firewall or IDS ... Im trying to explain to my management how useful the payloads could be ... Cenzic Hailstorm finds vulnerabilities fast. ...
    (Pen-Test)
  • Re: [fw-wiz] Firewall Primitives
    ... >A firewall gets a SYN packet aimed at port 23 on a machine behind ... >packet to the client, and logs a refused connection. ... >What does an IDS see? ...
    (Firewall-Wizards)