full-disclosure - IDS WIth TCP Reset and SPAN

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <002801c442c6$0f2cd250$0200000a@46rt90>
From: daind at qwest.net (Dain Deutschman)
Subject: IDS WIth TCP Reset and SPAN

Hello Group,

Hopefully, this topic is ok to discuss here. I am fairly new to IDS systems and am having trouble getting my cisco IDS to send TCP resets. The lab network is as follows:

               R4
R1----IDS----|
               R2------R3

R4 and R2 are on the same ethernet segment. R1 is on Command and Control side of the sensor. The attack is coming from R3 ( telnet to R4 and issue "testattack" string ). The alarm shows up in event viewer...but no tcp reset...I mean...my telnet session stays active. 

I know this probably has something to do with how I am setting up SPAN on the switch....but I am not sure. The IDS Sensing interface, R4 and R2 are on the same switch and in VLAN 20. R3 is in VLAN 30.

I have tried it without span ( just R4, R2 and IDS sensing interfaces in same vlan ) and with span configured as follows. Niether has worked.

monitor session 1 source vlan 20 rx
monitor session 1 destination int f0/17 ingress vlan 20

Any ideas??

Thanks,

Dain
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040525/614b74e0/attachment.html