Having your IDS respond automatically to an IP that is generating questionable traffic by dynamically managing your router ACLs (or other similar action; tcpwrappers, ipchains, etc...) to deny all traffic from the IP can be a risky thing to do from a DoS perspective; nmap's decoy option comes to mind. It would seem that any IDS should only block traffic from an IP based on an attack signature that requires bi-directional communication, like a CGI exploit over http/80 or something. Are there guidelines for deploying IDS response that discusses methods for minimizing false positives? Are there any *good* ways of doing this? --Mike http://www.math.umd.edu/~mbr
This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 14:03:03 PDT