RE: TippingPoint Releases Open Source Code for First Intrusion Pr evention Test Tool, Tomahawk

At 11:00 AM 11/2/2004 -0600, Compton, Rich wrote:
> Why the heck would a pcap be confidential?

There is a great deal of effort in generating pcap files.

On one hand, if you have 'live' traffic captured from a
university or corporation, there is a ton of sensitive
data like email and password in it.

On the other hand, if you have a lab, and your IDS/IPS
guys have actually taken the time to configure several
*hundred* different target systems, generate traces for
the several *thousand* common attacks and throw in traces
of Nessus, NeWT, eEye, ISS, NMAP, .etc and then throw in
traces of the web attacks permutated with the dozen or
so evasion techniques, one can see that the sheer effort
of cataloging, capturing and maintaining this data makes
it confidential.

Ron Gula, CTO
Tenable Network Security
http://www.tenablesecurity.com
Lightning   - Enterprise Security Manager
Thunder     - Enterprise Log Manager
NeVO        - Passive Vulnerability and Intrusion Sensor
Nessus/NeWT - Network and Host vulnerability Scanning







--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from 
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
--------------------------------------------------------------------------