Re: IDS testing tools

On 9/14/06, Akira Matsuno <catchb0dhi@gmail.com> wrote:

> Is nidsbench still a good tool to use , or is it significantly out of date now?

Well nidsbench is usually considered a suite of tools:

- Fragroute/Fragrouter - Quite amazing how many IDS/IPS's still have
problems with this, especially at higher rates or under load.  Neither
in active development AFAIK.

- Tcpreplay - Still in active development
(http://tcpreplay.synfin.net/) and very useful if you have relevant
pcap's to play with.  If you don't already have good pcaps, you'll
probably have a hard time finding quality ones which have already been
vetted.  Maybe one day http://openpacket.blogspot.com/ or some other
service will actually launch.

--
Aaron Turner
http://synfin.net/

------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw 
to learn more.
------------------------------------------------------------------------