Re: Firewall and IDS, (the second way).

From: Timothy J. Miller (cerebus@sackheads.org)
Date: 03/16/02 

From: "Timothy J. Miller" <cerebus@sackheads.org>
To: sekure@hadrion.com.br
Date: 16 Mar 2002 12:52:20 -0600

On Fri, 2002-03-15 at 12:41, sekure@hadrion.com.br wrote:

> I'm "walking" by the internet finding about paper/techniques that can be
> used to detect systemn with IDS installed. Try to detect
> snort/snort+aide/quinds/.../ somebody know something like it ??

There's only two ways of detecting an IDS that I know.

1) Look for the data stream from a remote sensor (sniffer) to wherever
it's stored and/or analyzed, or look for the alerts generated by the
IDS.

This isn't very useful, since it presupposes some measure of access to
the network in question. And if you've already got that, the IDS has
probably already alerted on you unless you're very, very paranoid and
very, very skilled.

2) Timing detection. AntiSniff from l0pht uses this method.

The theory goes like this: a network card usually discards ethernet
frames not destined for it, without passing those frames into software
processing. A card in promiscuous mode will process and forward up the
stack *all* frames.

So, you spend time pinging all systems on a network and collect the
average timing. Then you flood the network with garbage packets. NICs
not in promiscuous mode will ignore the trash, but any operating sniffer
will process them all, slowing the system some (hopefully) measurable
mount. In the middle of the flood, you ping everything again. Any
system that shows a statistically significant deviation from previous
timings is likely running a sniffer.

This also isn't very useful for remote sniffer detection. You need
access to the local network to inject all the garbage packets, and it's
noisy as hell. (Attempting to do this from *outside* the local segment
fails because normal variation in RTTs in the wild internet makes the
collected ping timing statistics useless to begin with.) Additionally,
varying load on other non-sniffer systems can lead to false positives.
This is primarily useful for a network admin to check a segment and see
if any *un*authorized sniffers have been installed.

Both methods are completely useless against sniffers that have no IP
address, or have out-of-band monitoring/alerting. Which is how they all
should be installed anyway. 8)

Relevant Pages

  • RE: Changes in IDS Companies?
    ... It does intrusion detection with alerting and pattern matching ... IDS is down...but at least your network isn't, ... ::: mode being rolled into Snort) are both good technologies ...
    (Focus-IDS)
  • Re: IDS evaluations procedures
    ... On 7/22/05, Nathan Davidson wrote: ... An IDS ... should be a policy failure detection system and a network transaction ...
    (Focus-IDS)
  • RE: IDS and Spywares
    ... I strongly disagree that IDS is not effective with spyware. ... Network based detection and BLOCKING is the most effective way I've seen ... This is layer 2, detection. ...
    (Focus-IDS)
  • Re: Recent anti-NIDS Gartner article
    ... > - Need expensive hardware for good performance and detection rate. ... An inline IDS is going to have all of the requirements ... Unless you cut the detection functionality, ... is essentially invisible to the network. ...
    (Focus-IDS)
  • Re: Changes in IDS Companies?
    ... I think that the intrusion prevention space will probably endup ... just like the detection space is. ... > Network intrusion prevention systems are also relatively untested and ... > complete lack of discussion about the downsides of such technologies. ...
    (Focus-IDS)
Quantcast