IDS, detection of encrypted packets within non-SSL traffic streams?

astroman — Sun, 10 Mar 2019 11:53:33 GMT

All...

Here's the scenario:

There's a host on the internal network that has a reverse shell to the outside world, and the packets being sent back to the attacker are encrypted, over a standard web (TCP/80) port - which is allowed by Websense or URL filter of choice.

Can a custom signature be created to alert on the detection of encrypted packets / data streams over non-encrypted transmissions? We've found other IDS/IPS systems that we're able to build custom sigs to detect and alert on these streams, but are wondering if we can do that in within Cisco IDS/IPS?

Please be specific if possible...let's assume the organization is using the latest version of Cisco IDS software.

Thanks in advance...

Re: IDS, detection of encrypted packets within non-SSL traffic s

bnidacoc — Wed, 17 Feb 2010 16:40:38 GMT

Have you got Sig 11233 series enabled? It does, BTW, appear to exclude "WEBPORTS." Maybe a copy could be made to exclude only TCP 443.

topic IDS, detection of encrypted packets within non-SSL traffic streams? in Network Security

IDS, detection of encrypted packets within non-SSL traffic streams?

Re: IDS, detection of encrypted packets within non-SSL traffic s