A Intrusion Prevention System (IPS) is a type of network security system which provides some level of proactive, automated defense against unauthorized access.

learn more… | top users | synonyms

0
votes
0answers
18 views

Snort Windows inline mode

I'm setting up Snort on Windows. I can test the inline mode but when I try to put it in inline mode so I can drop instead of alert. When I try to use the DAQ modules (afpacket) it says it can't find ...
0
votes
1answer
56 views

Is there a benefit from using an IPS for outgoing traffic?

It's probably a stupid question, but still may be it will be useful not only for me. I have an Juniper SRX firewall in a branch office. All ports are blocked from Internet to Internal network. All ...
1
vote
1answer
66 views

I can access http, https on server, but can't ping the server behind sonicwall tz500

I am not sure if this is possible or not. I have set up some web servers and ftp servers that are statically NATted behind a sonicwall tz500. I can access all via ftp, http, https. I have included ...
0
votes
1answer
69 views

only allow a specific port that can be connected by only one ip address at the same time

I have a open port, 40002, I want to limit that at the same time the port can only be connected by one ip address(not specific address). if there is an ip address conntecing to that port already, ...
0
votes
1answer
43 views

SNORT: Is a PCRE on SSNs intensive

I'm trying to write a Snort rule to look for SSNs. Due to the limitations of the appliance in place I can not use the pre-processor settings. How intense would it be to run a PCRE rule for SSNs? ...
0
votes
1answer
89 views

Forcing traffic through an IPS on a flat network through a bump in the wire

I have the following topology: Click here, unfortunently I don't have enough rep to post images Essentially I would like the packet flow to go from PC1, to the Core Switch, to the Edge Switch, and ...
-1
votes
2answers
194 views

How to open ports if there are multiple sub network behind a router or Public ip

Currently this is the our office network. We currently have a single Public ip from the ISP and we have created a single Private ip network behind the NAT as shown below : public ip ( WAN ) - ...
0
votes
0answers
87 views

Inter-VLAN Malicious Code Scanning

I am trying to find an inbuilt solution on a Cisco Catayst 3750X Switch to scan all traffic routed from one VLAN to another for malicious code. The situation is that we currently have a development ...
2
votes
1answer
2k views

fail2ban regex working but no action being taken

I have the following snippet of fail2ban configuration on Ubuntu 13.10 server: #jail.conf [apache-getphp] enabled = true port = http,https filter = apache-getphp action = ...
0
votes
1answer
88 views

Is a reverse proxy useful behind a load balancer and IPS

We have a Web infrastructure with a farm of Web Servers. They are behind a loadbalancer which does SSL offload. We also have a IPS and obviously a set of firewalls. Now, for security reason we have ...
1
vote
3answers
787 views

Simple application level file integrity monitoring & Intrusion detection (IDS)

We've been searching for a simple file integrity monitoring solution on CentOS/Linux that will work on the application level. We are not looking for OS/network level IDS as OSSEC and the others do a ...
-1
votes
1answer
3k views

(network.c.379) can't bind to port: 80 Address already in use

I have one server running both apache and lighttpd on two separate IPs. After rebooting the server I can't access the stuff on lighttpd: /etc/init.d/lighttpd restart (network.c.379) can't bind to ...
0
votes
2answers
939 views

Sonicwall IPS blocking Simple Help direct connection

We host a remote access tool called Simple Help. It allows us to access our clients computers and assist them with problems. I can log into it from my remote workstation, and connect to a clients ...
0
votes
1answer
1k views

Bridge Intrusion Prevention Vyatta

I am trying to create a bridge with ThreatStop, IPS and block a few ports. This bridge will sit in front of my servers. All is working apart from the IPS. I have read the documentation on configuring ...
1
vote
1answer
164 views

Stateful Signatures in an IPS

I am researching in-line IPS devices and their signatures both stateful and stateless. The test network I am looking to implement the IPS in has asymmetric traffic so stateful inspection would be ...
2
votes
5answers
7k views

How to manually download individual files from the OpenIndiana (or Solaris) pkg repo?

For a server in an offline environment, how would I download a package from http://pkg.openindiana.org/dev? (or the better known http://pkg.oracle.com) There is an install link which downloads a p5i ...
1
vote
3answers
15k views

Blocking Team Viewer

I'd like to block incoming TeamViewer connections to my network, but at the same time to allow outgoing TeamViewer connections. So that users can't connect to their work PCs with TV (circumventing ...
0
votes
1answer
1k views

Switch Before Firewall / Router - Multiple public IPs

I currently Have a 10Mbit Full duplex circuit connected to a small unmanaged switch which then connects to a Sonicwall Firewall / Router. I have several public IP addresses (/28) that are assigned to ...
2
votes
1answer
1k views

trying to figure out how to bridge two virtual networks together and in turn bridge that to the internet for a virtual inline IDS/IPS system

I'm trying to figure out how to bridge two vmware (server or workstation, workstation) or virtualbox networks together with a linux IDS/IPS system transparently inline between both the virtual ...
0
votes
1answer
151 views

Looking for a good DDOS IPS system [duplicate]

Could I get some recommendations on an IPS solutions that incorporates some form of DDOS protection / what do you currently implement on your network? Thanks
0
votes
1answer
630 views

How Does Cisco IPS Work?

How does it work? Does it typically have predefined patterns of trusted or malicious activity? Is it actually a category of firewall techniques? I am more curious about Cisco than I am about other ...
0
votes
1answer
1k views

Cisco ASA 5510 w/ AIP SSM - Can it inspect SSL traffic?

Is is possible for a AIP module within a Cisco 5510 ASA to decrypt and inspect SSL traffic? I have asked my local vendor (who placed the devices of which I speak) and they say that the AIP module is ...
1
vote
2answers
158 views

Web server hosting infrastructure, does IPS help?

I am working on setting up new networking for datacenter hosting a web site. We have following topology Internet -> Firewall1 -> ReverseProxy(for security) -> Web Server -> firewall2 -> databse ...
2
votes
1answer
401 views

iptables traffic redirection for multiple public ips

On my linux machine I have: - one physical interface eth0 with the public ip x.x.x.x - one logical interface eth0:0 with the public ip t.t.t.t - BIND DNS listening to t.t.t.t If I ping t.t.t.t from ...
1
vote
1answer
184 views

unable to get Honeynet Snort Inline Toolkit

I have to deploy a Snort based intrusion prevention system. I am total newbie in this, so any kind of help , references for starters would be highly appreciated. Also snort documentation talks about ...
5
votes
8answers
7k views

What is the best Web Application Firewall for IIS? [closed]

What is the best Web Application Firewall(WAF) for IIS? What makes it better than the others? How useful is it at blocking attacks against poorly written code, otherwise known as an Intrusion ...
0
votes
6answers
492 views

Sidewinder Firewall Replacement/Alternative

We own a Sidewinder G2 110D (out-of-stock) and love it. The product was reasonably priced, support was great, and the device was rock-solid. Since McAffee bought out SecureComputing, they have ...
5
votes
8answers
8k views

File transfer problems through VPN when Cisco IPS is enabled

We have a Cisco ASA 5510 firewall with the IPS module installed. We have a customer that we must connect to via VPN to their network to exchange files via FTP. We use the Cisco VPN client (version ...
0
votes
1answer
5k views

How to temporarily disable a Cisco IPS module for troubleshooting

I have a Cisco IPS module running in my ASA 5510 firewall. Right now I'm trying to troubleshoot a network/VPN problem that two of my users are having when they VPN into a remote partners site. I ...
1
vote
2answers
3k views

Adding a host to Cisco IPS Never Block List

We are running a Cisco ASA 5510 with the IPS module. We have an internal server that is preforming a lot of SNMP discovery scans and is being blocked and shutdown by the IPS. Since I'm in control ...