|
-
September 29th, 2004, 09:02 PM
#11
The ones you have listed nebulus look pretty much 'canned' rules. 
Cheers:
-
September 29th, 2004, 09:27 PM
#12
Figured it was, but thought i would add them anyway.
There is only one constant, one universal, it is the only real truth: causality. Action. Reaction. Cause and effect...There is no escape from it, we are forever slaves to it. Our only hope, our only peace is to understand it, to understand the 'why'. 'Why' is what separates us from them, you from me. 'Why' is the only real social power, without it you are powerless.
(Merovingian - Matrix Reloaded)
-
September 29th, 2004, 09:49 PM
#13
Neb:
If you look at them carefully they all look for something more specific that a simple NetBIOS connection. It's either administrative share access, viruses accessing shares and transferring themselves or whatever.
It really wouldn't help to be logging every transaction of this type on a larger network.... The alerts would be horrendous.
Don\'t SYN us.... We\'ll SYN you..... 
\"A nation that draws too broad a difference between its scholars and its warriors will have its thinking done by cowards, and its fighting done by fools.\" - Thucydides
-
September 29th, 2004, 09:53 PM
#14
Originally posted here by Tiger Shark
Neb:
If you look at them carefully they all look for something more specific that a simple NetBIOS connection. It's either administrative share access, viruses accessing shares and transferring themselves or whatever.
It really wouldn't help to be logging every transaction of this type on a larger network.... The alerts would be horrendous.
Well, seeing that I don't allow it on my LAN at home, it would be acceptible. It could also be useful to see in your DMZ zones assuming you don't allow it to be used out to the internet. I know the sigantures (the stock ones) are looking at specific content, that was more or less the point of saying 'hey, if someone that uses this more wants to add some filters, ie by looking at netbios content to look at something specific, then it wouldn't alarm as much as my original suggestion'.
Anyway, hope you guys follow, I think I am about to give up explaining why I said what I did 
There is only one constant, one universal, it is the only real truth: causality. Action. Reaction. Cause and effect...There is no escape from it, we are forever slaves to it. Our only hope, our only peace is to understand it, to understand the 'why'. 'Why' is what separates us from them, you from me. 'Why' is the only real social power, without it you are powerless.
(Merovingian - Matrix Reloaded)
Posting Permissions
- You may not post new threads
- You may not post replies
- You may not post attachments
- You may not edit your posts
-
Forum Rules
|
|
Reply With Quote