Stealthful Sniffing, Logging, and Intrusion Detection

Architecture and Background

Mick Bauer - Stealthful Sniffing, Logging, and Intrusion Detection: Useful and Fun Things You Can do Without an IP Address Centralized event-logging and automated intrusion detection are required tools for good network security.

Vulnerability Analysis

But what can you do to prevent your loggers and IDS probes from falling victim to the same attacks they're supposed to warn you about?

Exploitation and Demonstrations

As it happens, one cool thing you can do is run such systems without IP addresses.

Remediation and Defensive Strategies

In my presentation I'll describe the benefits and drawbacks of this technique, and demonstrate how it can be used in conjunction with Snort, syslog-ng, and other standard *nix tools to build stealthful loggers and IDSes. Mick Bauer is a Technology Counselor (information Systems security consultant and engineer) for Upstream Solutions, based in Minneapolis. His areas of expertise include firewall architecture and integration, security policy, network application security, and Unix and NT system security. Mick is the author of Linux Journal's popular "Paranoid Penguin" security columns, and of the upcoming book "Building Secure Servers With Linux" (O'Reilly and Associates, October 2002).