UDP Port Sweep

[roxanne.tsui]

We noticed that some of the events triggered by signature 4003 (Nmap UDP Port Sweep) look like responses from external DNS servers. The signature description also mentioned about this scenario.

We wish to understand why the signature cannot track corresponding requests and responses, as in the PIX firewall?

Thanks.

[vkapoor5]

What IDS appliance are you using? For IDS 42XX appliance, you may refer to the NSDB for more information on the signatures.

Not sure of how PIX tracks both request and responses.

[roxanne.tsui]

We are using IDS-42xx sensors. We have referenced the NSDB, and have followed some of the recommendations for benign triggers. The case we raised is responses from external DNS servers.

We know that PIX logs outgoing DNS requests in translation tables. The PIX ASA together with the DNS Guard feature ensure that there is only 1 response to each outbound DNS request. We are wondering whether IDS can offset the outgoing well-known service requests with incoming responses; and alert only when the net counts exceed the threshold. Is it feasible, and if not, what is the difficulty and limitation. Just want to better understand and use the signature. Thanks.