This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Is IPS dead or have all the internet attacks just stopped?

Gents and Ladies,

I have zero length IPS log files for the first time in 5 years.  It is configured with every single attack and warning pattern switched on and alerting.  That is over 9,500 patterns and NOT one is picking up anything to be worried about either for outgoing traffic or incoming traffic.

My questions are

1. Is your IPS quiet as a grave too?
2. Are all your IPS log files in /var/log/ips/2011/04/ all zero lenth when you gunzip them?
3. How do you tell how many patterns are actually loaded in snort, when the gui says 9500 odd?

I am used to many things with Astaro IPS including patterns shutting down my clients' firewalls, but I am not used to zero length log files and feel rather uncomfortable about this.

So, I tried to get IPS to respond by running half a dozen different scans (including PCI scans) using Nessus, nmap and LanSpy.  Found out some DNS vulnerabilities, but IDS still stoney quiet.  Restarting snort with /var/mdw/scripts/snort restart shows a pile of stuff including about 50 lines of this: "DynamicPlugin: Rule [3:16418] not enabled in configuration, rule will not be used."  but googlepedia suggests this is not a problem.

Where are you at with this?

Thanks in advance for your replies.

Best Regards,

Adrien.

This thread was automatically locked due to age.

Parents

0 AdrienBelcourt over 14 years ago

thanks Barry & Jaznak,

Jaznak, all those IPS alerts look like they are for traffic originating from LAN.  I wonder if there are any IPS alerts for hacking attempts from the outside world.

Barry, when I was running Astaro Versions 4-6 I would expect IPS alerts to build up even when I was not surfing at all due to the attempted exploits from the outside world.  So a zero count for IPS alerts is just does not feel right to me.

Again the problem is that we went from 500-1000 IPS alerts per day to Zero following a pattern update.  Best case is that IPS is still doing its job but the alerts are no longer working.  We all know the worst case....

What is a guaranteed way to get IPS to generate alerts?  I thought Nessus/Nmap vulnerability scans should be able to do that (from Top 10 Vulnerability Scanners).

IPS did not react at all while 9 different vulnerabilities were uncovered by Nessus.

I would have thought that IPS should be able to detect network surveillance using a tool like Nessus at least.

Try it on your own system - or send me your external IP, and I will send you a report of your vulnerabilities.

Will keep you posted.

Adrien.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 AdrienBelcourt over 14 years ago

thanks Barry & Jaznak,

Jaznak, all those IPS alerts look like they are for traffic originating from LAN.  I wonder if there are any IPS alerts for hacking attempts from the outside world.

Barry, when I was running Astaro Versions 4-6 I would expect IPS alerts to build up even when I was not surfing at all due to the attempted exploits from the outside world.  So a zero count for IPS alerts is just does not feel right to me.

Again the problem is that we went from 500-1000 IPS alerts per day to Zero following a pattern update.  Best case is that IPS is still doing its job but the alerts are no longer working.  We all know the worst case....

What is a guaranteed way to get IPS to generate alerts?  I thought Nessus/Nmap vulnerability scans should be able to do that (from Top 10 Vulnerability Scanners).

IPS did not react at all while 9 different vulnerabilities were uncovered by Nessus.

I would have thought that IPS should be able to detect network surveillance using a tool like Nessus at least.

Try it on your own system - or send me your external IP, and I will send you a report of your vulnerabilities.

Will keep you posted.

Adrien.
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data