GenII Data Control for Honeynets: Understanding and Building Snort-Inline Data Control : Attack Prevention

Attack Prevention » Intrusion Detection » Honeypots » GenII Data Control for Honeynets: Understanding and Building Snort-Inline Data Control

GenII Data Control for Honeynets: Understanding and Building Snort-Inline Data Control

Details

Submitted: 05/14/10
Views: 87 views, 0 incoming clicks. Averaging 1 views and 0 incoming clicks per day.
In the most recent 30 day period, there've been 20 views and 0 incoming clicks.
Rating: 0/5 based on 0 votes. The median rating is 0.

GenII Data Control for Honeynets: Understanding and Building Snort-Inline Data Control

Description: Data control is a must if you are running high-interaction honeypots. The purpose of data control is to protect us from upstream liability. As we learned from reading this paper data control is somewhat of a skill that can only be learned through real world experience. GenI data control's alert.sh script is easy to deploy and configure making it perfect for those just getting started with high interaction honeypots. The limitation of GenI data control is that it operates one notch up in the stack at Layer3 making it easier to detect by our enemy. Also, GenI data control only works in connection limit mode. GenII data control operates at Layer2 making it difficult to detect and offers us more options to capture our enemy's motives, tools, and tactics. We can build our GenII data control system for connection limiting, or we can QUEUE enable the packets for Snort where a verdict can be set to determine the fate of each packet based on how the Snort signatures are implemented.
Read More

Discussion: 0 comments

Tags:

Sorry, you don't have permission to post. Log in, or register if you haven't yet.

Please login or register.

Members currently reading this thread:

Discussion (0) Report

Report