> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/knowledge-base/english/intrusion-detection-system-ids/what-types-of-network-attacks-does-the-enginsight-ids-detect.md). # What types of network attacks does the Enginsight IDS detect? With the Enginsight Intrusion Detection System (IDS), you can monitor and analyze network traffic on all servers and clients where the Enginsight agent Pulsar is installed. This allows you to detect attacks, misuse, and violations of security policies. To detect network anomalies and attacks, system and network activities are analyzed using several thousand predefined rules, primarily [Snort Community Rules](#snort-community-rules). *** ## General Network Attacks The Enginsight IDS supports the detection of the following attacks:
Network attackDescription
SYN floodingSYN flooding is a denial-of-service (DoS) attack that overloads web servers with a flood of half-open TCP connections. Attackers send large numbers of connection requests (SYN) but do not complete the request with an ACK response. As a result, the server reserves memory for a response that never arrives until the memory is exhausted and a service or the entire system becomes unavailable.
ARP spoofingARP spoofing is a network attack in which an attacker sends forged Address Resolution Protocol (ARP) messages to a local network. This causes data packets, such as credit card data, to be redirected to the attacker instead of being sent to a legitimate device, allowing the attacker to read and manipulate them.
Ping of Death (PoD)A Ping of Death attack is a DoS attack in which an attacker sends ICMP requests (pings) containing data packets that exceed the maximum permitted packet size. This causes a buffer overflow, meaning the buffer is overloaded until the affected system freezes or crashes completely.
Ping DDoSIn a distributed denial-of-service (DDoS) attack via ping, attackers use multiple distributed systems to send ICMP requests to a target system at the same time. The incoming requests overload the target system, causing it to become significantly slower or crash completely.
DNS spoofingDNS spoofing is a network attack in which the mapping of an IP address to a domain name is forged. As a result, a visitor who wants to access the legitimate website associated with that domain is redirected to a fake website controlled by the attacker, allowing the attacker to capture sensitive data.
Port scan (TCP and UDP ports)In a port scan, attackers systematically scan network ports on an IP address to find an open door through which further malicious actions can be carried out. Port scans can be used, for example, to identify active services or operating systems whose known vulnerabilities can then be exploited.
Brute-force attack

In a brute-force attack, attackers automatically try a wide range of password combinations to break into a target system.

The Enginsight IDS can detect brute-force attacks against the following services:

  • SSH (Secure Shell)
  • MySQL
  • MongoDB
  • HTTP Basic Authentication
  • FTP (File Transfer Protocol)
  • RDP (Remote Desktop Protocol)
  • RPC (Remote Procedure Call)
  • VNC (Virtual Network Computing)
  • SMB (Server Message Block)
Cross-site scripting (XSS)In cross-site scripting, attackers inject malicious scripts into trusted websites. These scripts are then executed in a visitor’s browser. This allows an attacker, for example, to steal session cookies and other data or even take over accounts.
HTTP request corruptionHTTP request corruption refers to the modification of data while an HTTP request is being transmitted between client and server. HTTP headers manipulated by an attacker can then lead to additional security vulnerabilities, for example, if the server processes the manipulated data.
HTTP response splittingHTTP response splitting is a vulnerability in which an attacker can manipulate a server’s HTTP response by injecting special control characters and splitting the response. This allows the attacker, for example, to set their own cookies, manipulate redirects, or load false content into the cache.
HTTP request smugglingIn HTTP request smuggling, an attacker manipulates multiple HTTP requests so that they are interpreted differently by different components, for example when frontend and backend servers disagree on where an HTTP request ends. This allows an attacker to smuggle in additional HTTP requests, which can then be used to take over sessions or access protected resources.
Remote code execution (RCE)In remote code execution, an attacker exploits a vulnerability in an application, service, or operating system to execute arbitrary code remotely on a target system without needing physical access to the system.
Path traversalPath traversal allows attackers to gain unauthorized access to files and directories outside the web root directory. Attackers use special character sequences such as ../ to move up the directory tree into parent folders and, for example, read password files on the server.
SQL injectionIn SQL injection, an attacker injects malicious SQL commands into input fields in web applications in order to manipulate the underlying database and, for example, read, delete, or modify sensitive data.
SSL/TLS cipher enumerationIn SSL/TLS cipher enumeration, all encryption algorithms supported by a server are queried, including TLS versions, key lengths, and key algorithms. This allows an attacker to identify vulnerabilities that can be exploited further.
SSL/TLS protocol scanIn an SSL/TLS protocol scan, an attacker examines the system for the use of outdated SSL/TLS protocol versions, configuration errors, and other vulnerabilities that can be exploited further.
Bot activityA bot is a software program that is active on the internet and performs repetitive tasks. In a bot attack, for example, automated scripts are used to impair a website’s performance, steal data, or carry out other malicious actions.
Blacklisted IP databaseEnginsight checks whether IP addresses are already listed on a known blacklist.
*** ## Snort Community Rules Enginsight also supports the detection of attacks described in the [Snort](https://www.snort.org/) Community Rules. These also include more specific attacks, such as attacks against Microsoft IIS or Exchange Server, attempts to access sensitive data on a web server, or Common Gateway Interface (CGI) attacks. {% hint style="info" %} The Snort Community Rules in use are licensed under the [GPLv2 license](https://www.snort.org/gpl). {% endhint %} ***