Jeff,
It's actually pretty common in the telco world. ILMI for those from
the ATM world is how operators in the telco world manage equipment over
the same wire. In that case it's VPI/VCI in this case they have no IP
addresses but they listen for an IP address - once they see the IP
address they act differently. The danger is that the device can be
attacked on the wires it's protecting. I would suggest you run *SIC,
(ISIC, etc) on the network address to see how strong the stack that is
providing the management is. It's generally not recommended to have
your management interface exposed to the network you are protecting.
Example, let's say they have a HTTPS interface - why not flood the data
path with HTTPS traffic to that IP address and see if you could slow
down the device - or perhaps you can discover what type of device it is
and they figure out what it's weak on.
Dennis Cox
Director of Engineering, TippingPoint Technologies
w 512.681.8328
On Jan 5, 2005, at 2:17 PM, Jeff McCarthy wrote:
Hello,
I recently sat in on an IPS vendor presentation. They
stated that their IPS has 2 Ethernet interfaces,
neither of which have IP addresses yet they can manage
and monitor the device over IP. I thought this was
interesting and somewhat unique.
Are there any other vendors that do that? I know at
least one other vendor has no IP on the interfaces
listening to traffic but they have a seperate
interface with an IP for management.
Thanks,
Jeff McCarthy
USM
__________________________________
Do you Yahoo!?
Yahoo! Mail - Easier than ever with enhanced search. Learn more.
http://info.mail.yahoo.com/mail_250
-----------------------------------------------------------------------
---
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to
http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
-----------------------------------------------------------------------
---
--------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
--------------------------------------------------------------------------
