How we did it

Our test bed consisted of an "attacker" system running Red Hat 6.2; a router (also running Red Hat 6.2); a "victim" running Windows 98 SE, an Ixia 1600 Traffic Generator and Analyzer; and a Cisco Catalyst 6506 with a 48-port switch module and the Cisco Catalyst 6000 IDS Module running software Version 2.5(1) s1. We tested using the Cisco Catalyst Operating System Version 6.1(1a) and the Cisco Secure Policy Manager (CSPM) Version 2.2. Each device was connected directly to the Cisco Catalyst 6506 switch, except for the attacker, which was connected on a different subnet on the far side of the router.

Using an Ixia 1600 box to generate background traffic, we executed a number of attack scripts - one at a time - against the victim machine. We tested using denial-of-service attacks, including IIS Dot Dot DoS; access exploit attacks, such as IIS BAT Exe and Alibaba Attack; and a buffer overflow attack. We also selected attacks that would be directed at various operating systems (Solaris, Unix and Windows NT) and Web-server software (IIS and Apache). As attacks were occurring, we noted how quickly the Catalyst 6000 IDS Module detected the attack and recorded it on the CSPM console. We also measured the throughput of the cumulative traffic (background and attack traffic) passing through the Catalyst switch. All throughput measurements were based on 512-byte packets.

Yocom is senior editor, Brown is test engineer of security products and Van Derveer is a lab test technician at Mier Communications, a strategic consulting and product test center in Princeton Junction, N.J. They can be reached at byocom@mier.com or kbrown@mier.com.

Review: Cisco offers wire-speed intrusion detection