A friend came to me who also works in the IS/IT field and posed a questioin to me that I was not completely sure how to answer with regards to intrusion detection/prevention systems. If an outside attack is launched against a networks internal perimeter that starts out with Nmap and Nmap reports back program identification version numbers, open ports on one server, then moves onto another server and gets the same information but at the third server Nmap is stopped - what happened. This scenario is based on a test lab situation that I do not know all the configuration information on. What I do know, is that when I went to his companies lab and repeated his steps, I also tried to ping the ping the firewall, and the edge router. Obviously the network security engineer had configured the IDPS to blackholed the sending IP address. I spoke with the security guy and he said I was correct about being blackholding. Now I am not a security expert but my friend Doug is and the security guy Tom said that Doug needs to play with the test systems to learn more. But now I am curious, what other steps can you take to penetrate an IDPS in a test lab setting. My thoughts are to use vulnerability scanners, port scanners, firewall analysis tools, just about what every is available to get a foortprint. Clearly there is no honey pot/net setup of padded cell, or we could have gotten into a decoy system. I am going back to see Doug and Tom on Friday to do some more work and learning, but right now I am at a lose for any thoughts as to what other steps might be taken. This is sort of driving me nuts because I am finishing up a Ph.D. in Information Systems Science and I have never had to face such a huge corporate test bed.

Any ideas or points in a direction would be apprciated. "And, no, I am not a hacker, and no I am not trying to "illegally" break into any systems." My dissertation is on IS/IT ethics and Personally Identifiable Information privacy rights.