IDS

[Guest]

[Ignacio]

I have an Endian Firewall Community release 2.2
How can I check if it is working well intrusion detection?
Days ago I do not see messages in Registration - Services - IDS

[whoiam55]

I don't know who to test IDS exactly, but one thing you can do it, run a torrent client in your network.

If IDS is working Endian should report something like this in it's log(IDS)

Code:

 snort[4389]: [1:2000334:9] ET P2P BitTorrent peer sync [Classification: Potential Corporate Privacy Violation] [Priority: 1]: {TCP} 5.5.5.5:51439 -> 5.5.5.5:17445

ps: The IP in this example are change just to save my a$$.