Test 1.1 - Attack Recognition

Attacks

Default
ARR

Custom
ARR

Test 1.1.1 - Backdoors

Test 1.1.2 - WINS/DNS

Test 1.1.3 - DOS

Test 1.1.4 - False negatives (modified exploits)

Test 1.1.5 - Finger

Test 1.1.6 - FTP

Test 1.1.7 - HTTP

Test 1.1.8 - ICMP

Test 1.1.9 - Reconnaissance

Test 1.1.10 - RPC

Test 1.1.11 - SSH

Test 1.1.12 - Telnet

Test 1.1.13 - Database

Test 1.1.14 - Mail

Test 1.1.15 - Voice

Total

�

Test 1.2 - Resistance to False Positives

Default

Custom

Test 1.2.1 - Suspicious FTP traffic

Test 1.2.2 - HTTP “exploit” using incorrect method

Test 1.2.3 - Retrieval of Web page containing “suspicious” URLs

Test 1.2.4 - Simple SMTP QUIT command

Test 1.2.5 - Normal NetBIOS copy of “suspicious” files

Test 1.2.6 - Normal NetBIOS traffic

Test 1.2.7 - POP3 e-mail containing “suspicious” URLs

Test 1.2.8 - POP3 e-mail with “suspicious” DLL attachment

Test 1.2.9 - POP3 e-mail with “suspicious” Web page attachment

Test 1.2.10 - SMTP e-mail transfer containing “suspicious” URLs

Test 1.2.11 - SMTP e-mail transfer with “suspicious” DLL attachment

Test 1.2.12 - SMTP e-mail transfer with “suspicious” Web page attachment

Test 1.2.13 - SNMP V3 packet with invalid parameter

Test 1.2.14 - Fake DNS /bin/sh buffer overflow

Test 1.2.15 - Inter-firewall communication traffic

Test 1.2.16 - Fake SQL Slammer traffic

Test 1.2.17 - File copy of GIF file (contains bytes which look like NOP sled)

Total Passed

Test 2.1 - Evasion Baselines

Detected?

Test 2.1.1 - NSS Back Orifice ping

Test 2.1.2 - Back Orifice connection

Test 2.1.3 - FTP CWD root

Test 2.1.4 - ISAPI printer overflow

Test 2.1.5 - Showmount export lists

Test 2.1.6 - Test CGI probe (/cgi-bin/test-cgi)

Test 2.1.7 - PHF remote command execution

Total

Test 2.2 - Packet Fragmentation/Stream Segmentation

Detected?

Decoded?

Test 2.2.1 - IP fragmentation - ordered 8 byte fragments

�

Test 2.2.2 - IP fragmentation - ordered 24 byte fragments

�

Test 2.2.3 - IP fragmentation - out of order 8 byte fragments

�

Test 2.2.4 - IP fragmentation - ordered 8 byte fragments, duplicate last packet

�

Test 2.2.5 - IP fragmentation - out of order 8 byte fragments, duplicate last packet

�

Test 2.2.6 - IP fragmentation - ordered 8 byte fragments, reorder fragments in reverse

�

Test 2.2.7 - IP fragmentation - ordered 16 byte fragments, fragment overlap (favour new)

�

Test 2.2.8 - IP fragmentation - ordered 16 byte fragments, fragment overlap (favour old)

�

Test 2.2.9 - TCP segmentation - ordered 1 byte segments, interleaved duplicate segments with invalid TCP checksums

Test 2.2.10 - TCP segmentation - ordered 1 byte segments, interleaved duplicate segments with null TCP control flags

Test 2.2.11 - TCP segmentation - ordered 1 byte segments, interleaved duplicate segments with requests to resync sequence nos. mid-stream

Test 2.2.12 - TCP segmentation - ordered 1 byte segments, duplicate last packet

�

Test 2.2.13 - TCP segmentation - ordered 2 byte segments, segment overlap (favour new)

�

Test 2.2.14 - TCP segmentation - ordered 1 byte segments, interleaved duplicate segments with out-of-window sequence numbers

Test 2.2.15 - TCP segmentation - out of order 1 byte segments

�

Test 2.2.16 - TCP segmentation - out of order 1 byte segments, interleaved duplicate segments with faked retransmits

Test 2.2.17 - TCP segmentation - ordered 1 byte segments, segment overlap (favour new)

�

Test 2.2.18 - TCP segmentation - out of order 1 byte segments, PAWS elimination (interleaved dup segments with older TCP timestamp options)

Test 2.2.19 - IP fragmentation - out of order 8 byte fragments, interleaved duplicate packets scheduled for later delivery

Test 2.2.20 - TCP segmentation - ordered 16 byte segments, segment overlap (favour new (Unix))

Total

Test 2.3 - URL Obfuscation

Detected?

Decoded?

Test 2.3.1 - URL encoding

Test 2.3.2 - /./ directory insertion

Test 2.3.3 - Premature URL ending

Test 2.3.4 - Long URL

Test 2.3.5 - Fake parameter

Test 2.3.6 - TAB separation

Test 2.3.7 - Case sensitivity

Test 2.3.8 - Windows \ delimiter

Test 2.3.9 - Session splicing

Total

Test 2.4 - Miscellaneous Obfuscation Techniques

Detected?

Decoded?

Test 2.4.1 - Altering default ports

Test 2.4.2 - Inserting spaces in FTP command lines

Test 2.4.3 - Inserting non-text Telnet opcodes in FTP data stream

Test 2.4.4 - Polymorphic mutation (ADMmutate)

Test 2.4.5 - Altering protocol and RPC PROC numbers

Test 2.4.6 - RPC record fragging (MS-RPC and Sun)

Test 2.4.7 - HTTP exploits to port <> 80

Total

Test 3.1 - Stateless Attack Replay

Alert?

Pass/Fail

Test 3.1.1 - Stateless Web exploits

Test 3.1.2 - Stateless FTP exploits

Test 3.2 - Simultaneous Open Connections (default settings)

Number of open connections

Test 3.2.1 - Attack Detection

Test 3.2.2 - State Preservation

Test 3.3 - Simultaneous Open Connections (after tuning)

Number of open connections

Test 3.3.1 - Attack Detection

Test 3.3.2 - State Preservation

Test 4.1 - UDP traffic to random valid ports

�

150Mbps

�

300Mbps

�

450Mbps

�

600Mbps

�

Max

Test 4.1.1 - 256 byte packet test - max 270,000pps

Test 4.1.2 - 550 byte packet test - max 132,000pps

Test 4.1.3 - 1000 byte packet test - max 73,000pps

Test 4.2 - HTTP “maximum stress” traffic with no transaction delays

�

150Mbps

�

300Mbps

�

450Mbps

�

600Mbps

�

Max

Test 4.2.1 - Max 1500 connections per second - ave packet size 1000 bytes - max 73,000 packets per second

Test 4.2.2 - Max 3000 connections per second - ave packet size 540 bytes - max 135,000 packets per second

Test 4.2.3 - Max 6000 connections per second - ave packet size 440 bytes - max 165,000 packets per second

Test 4.2.4 - Max 12000 connections per second - ave packet size 360 bytes - max 198,000 packets per second

Test 4.3 - HTTP “maximum stress” traffic with transaction delays

�

150Mbps

�

300Mbps

�

450Mbps

�

600Mbps

�

Max

Test 4.3.1 - Max 3000 connections per second - ave packet size 540 bytes - max 135,000 packets per second - 10 sec delay - max 50,000 open connections

Test 4.3.2 - Max 6000 connections per second - ave packet size 440 bytes - max 165,000 packets per second - 10 sec delay - max 50,000 open connections

Test 4.4 - Protocol mix

150Mbps

300Mbps

450Mbps

600Mbps

Max

Test 4.4.1 - 72% HTTP (540 byte packets) + 20% FTP + 6% UDP (256 byte packets). Max 2400 connections per second - ave packet size 540 bytes - max 129,000 packets per second - max 450 open connections

Test 4.5 - Real World traffic

150Mbps

300Mbps

450Mbps

600Mbps

Max

Test 4.5.1 - Pure HTTP (simulated browsing session on NSS Web site). Max 2800 connections per second - 12 new users per second - ave packet size 560 bytes - max 126,000 packets per second

Test 4.5.2 - Protocol mix - 72% HTTP (simulated browsing sessions as 2.5.1) + 20% FTP + 6% UDP (256 byte packets). Max 2200 connections per second - ave packet size 560 bytes - max 123,000 packets per second - max 900 open connections

Test ID

Result

Test 5.1.1 - ISIC/ESIC/TCPSIC/UDPSIC/ICMPSIC

�

Test ID

Result

Test 6.1.1 - Open Ports

Test 6.1.2 - ISIC/ESIC/TCPSIC/UDPSIC/ICMPSIC

Test 6.1.3 - ISIC attacks detected against management interface?