Look Who it Was Random video

DEF CON 13 - jives, Passive Host Auditing

35 views · Published 7 February 2014 · 24:12 · Indexed 14 November 2026

Channel: DEFCONConference · 2014 · Science & Technology

Watch on YouTube

jives, Passive Host Auditing

Traditionally, IDS systems such as snort have been used to monitor attacks against or within a network. This talk will give the outline for turning those tools around and instead using them to audit networks. We will discuss how to identify OS, tell who is patching, what services are being deployed (perhaps insecurely), and other methods for policy enforcement. This discussion is ideally suited for administrators and security professionals in open and/or decentralized environments, especially those charged with auditing the network. While several signatures and sample scripts will be discussed during this talk, this is a relatively new area of auditing and network security so questions, comments and volunteers will all be welcome.

Jives has been doing computer security at a major research university for over 5 years. After initially specializing in host security he has moved into network security. In this area he has written several evidence gathering scripts. Recently he has made a hobby out of using the network to answer questions about the host.

More from this channel