Hello,

the ISS RealSecure Network Engine has the
possibilty to respond to detected attacks with
a RST-TCP-packet (RS-Kill).

my questions are:

To which IP-Dest addresses RealSecure sends
the RS-Kill (server or client or both) ?

Which MAC-Src address RealSecure uses for
building the RS-Kill (the own or faked for
server, client (router)) ?

If RealSecure uses the own MAC then you have
false entries in the arp cache of router/switch.

If RealSecure uses faked MAC for server or client
then you have false entries in the bridging table
of the switch.

Exist any solutions for this (potential) problem ?

Birk

---------------------
secunet
Security Networks AG Fon/Fax: (03 51) 4 39 59-30/59
Ammonstrasse 72 Mobil: (01 71) 2 20 83 79
01067 Dresden E-Mail: b.richtersecunet.de
                        URL: www.secunet.de

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]