Signature to compare data

[avanzaadmin]

Hi folks

I got a question today that left we thinking and no answer.

Can I, on an IPS 7.x, create a rule that compares data in a HTTP flow?

Example: User send a login request in clear text but the server responds with a different account. A custom packet sniffer app would store the data, extract the login, store it as a variable and then compare it with the response. Easy, but can the IPS do that?

Regards

Fredrik

[Scott Fringer · Accepted solution]

Fredrik;

  No, the IPS is not designed to store values for later comparison - it only checks the data in the current flow.

Scott

[avanzaadmin]

Plain and simple, as I suspected. Thank you.

Regards

Fredrik