Cisco IDS General questions

[r-lemaster]

We're evaluating deploying a Cisco NIDS on our network. Someone told me that the Cisco IDS solution is based on NT (?!). Say it ain't so!

Also, can the NIDS or IDS module detect common IIS attacks like buffer overflows, directory transversals, code red/blue/etc.? Can the IDS in the PIX firewall detect these attacks?

Thanks for your time.

[ywadhavk]

The 3.x version of NIDS are Solaris based while as the 4.x are Linux based.

IDS does detect the IIS buffer overflow. Please refer to the below url for the signature database (NSDB)

http://www.cisco.com/cgi-bin/front.x/csec/idsAllList.pl

IIS overflow sigs are 5246 thro 5248.

PIX IDS has only a samll subset (approx.75) of these signature.

Hope this helps.

Thanks,

yatin

[r-lemaster]

Thanks, that was helpful.

Could you reply with a URL to a list of PIX IDS signatures?

[pcomeaux]

See Table 2-4 in this link:

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_sw/v_63/63syslog/pixemsgs.htm

peter

[pcomeaux · Accepted solution]

With the IDS 4.0 code, all sensors that support this code run Linux, including the stand-alone sensors and the new IDSM-2.

In the older 3.0 code, the stand-alone appliances ran Unix while the sensor blade for the 6500 ran Windows.

Here's a link to the chapter on signature engines for the 4.0 code:

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/csids/csids9/idmiev/swappa.htm

This will give you great insight to the power of the IDS 4.0 signature engines and the signature list, which includes most of the signatures you mention above.

hope this helps,

peter