IDS Sensor operation

Hi folks

 
Basically sensors operates with promiscuous mode interface  for monitoring
data,rite
But there is an optionality in  an IDS to alert the firewall (reconfigure)to
block the intrusion IP, and also to kill the session or connectionby the
sensor itself.

this we see in Realsecure Network sensor 7.0 where there  is a option called
RSKILL.

But the question is how is it possible for a interface in promiscuous mode
to act like this since there is no binding in the interface(TCP/IP,etc).

Did it uses other NIC which is for management purpose???

Hope u all understand the question



Regds
Vijai.K



DISCLAIMER 
This message and any attachment(s) contained here are information that is
confidential, proprietary to HCL Technologies and its customers. Contents
may be privileged or otherwise protected by law. The information is solely
intended for the individual or the entity it is addressed to. If you are not
the intended recipient of this message, you are not authorized to read,
forward, print, retain, copy or disseminate this message or any part of it.
If you have received this e-mail in error, please notify the sender
immediately by return e-mail and delete it from your computer.



--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from CORE 
IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to 
learn more.
--------------------------------------------------------------------------