3 ms·
Snort can at least get you close. A custom snort module maybe able to do the specific cert: https://www.snort.org/faq/readme-ssl https://www.snort.org/faq/readm
by kyrra 10y ago
Snort can at least get you close. A custom snort module maybe able to do the specific cert: https://www.snort.org/faq/readme-ssl https://www.snort.org/faq/readme-ssl
It's stream5 preprocessor can deal with most evasion techniques as it does full tcp stream reconstruction.
http://manual-snort-org.s3-website-us-east-1.amazonaws.com/node17.html#SECTION00323600000000000000 http://manual-snort-org.s3-website-us-east-1.amazonaws.com/n...
- 0x0 10y agoBut does that scale to ISP or even country level of traffic? Having enough RAM to reassemble all the TCP connections in a country sounds wild.
- kyrra 10y agoSnort is now owned by Cisco (the company is formerly known as Sourcefire). It makes money via hardware integrated with snort. I think a single 3U box pushes 60Gbps. Though that number is highly dependent on the tuning for stream5 and other preprocessors. You don't need to reconstruct the entire stream, just enough to know what the connection is doing. Normally it's only a few packets per stream. Stream fragmentation has its own entire configuration in snort as it is a known attack method to bypass detection. Last I remember that top end box was 2x 12 or 16 core Xeon CPUs with 256GB ram.