Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email email@example.com
From: Kurt Seifried (bugtraqseifried.org)
Date: Fri Sep 28 2001 - 06:40:53 CDT
One simple way would be to shove a lot of traffic through and then launch
attacks (get code from packetstorm or similar). You know what you are
sending, and by checking the reports can easily figure out what % of attacks
are detected, also how good the info is (i.e.: attack foo detected" verses
"attack foo detected, go find all your win2k servers and make sure patch
#xxx is applied"). Plus there are things like Dug Song's frag router and
other tools you can use to make the IDS's life more realistic (you better
believe attackers use this stuff).
Kurt Seifried, kurtseifried.org
A15B BEE5 B391 B9AD B0EF
AEB0 AD63 0B4E AD56 E574
----- Original Message -----
From: "hu jinhua" <hujhneusoft.com>
Sent: Friday, September 28, 2001 12:00 AM
Subject: Evaluation for IDS
> I need help about testing methodology for IDS, or
> criteria about evaluating IDS. who can tell me about
> Someone who have knowledge about this please
> mail me. My E-mail address is hujhneusoft.com.
> Thanks very much!