


Detecting when an internal system begins to port scan other systems.Detecting when new hosts are added to the network.Detecting when an application is compromised or subverted.Keeping track of all client and server application vulnerabilities.A single PVS sensor can be placed in front of a network of 25,000 systems and continuously monitor the traffic for a variety of security related information including: As PVS monitors your network, it also watches for potential application compromises, trust relationships, and open or browsed network protocols. The PVS vulnerability monitor can find out what is happening on your network without actively scanning it. Do you know what happens between the last time a vulnerability scan is completed and the next time a scan is completed? New hosts, new ports, new services, and new vulnerabilities can arrive on your networks faster than you may be allowed to scan for them. Introduction PVS is a passive vulnerability scanner. Table of Contents Family Web Clients.158 Family Web Servers.216 Family Abuse.290 Family Policy.291 Family Data Leakage.299 Family SCADA.308 Family Mobile Devices.318 Family Internet Services.327

Table of Contents Introduction.1 PVS PLUGIN FAMILIES.2 Family Backdoors.4 Family CGI.8 Family Database.45 Family DNS Servers.61 Family Finger.65 Family FTP Servers.66 Family FTP Clients.71 Family Generic.73 Family Operating System Detection.106 Family IMAP Servers.113 Family Internet Messengers.116 Family IRC Clients.122 Family IRC Servers.124 Family Peer-To-Peer File Sharing.125 Family POP Server.128 Family RPC.130 Family Samba.133 Family SMTP Clients.136 Family SMTP Servers.146 Family SNMP Traps.154 Family SSH.155 Passive Vulnerability Scanner (PVS) Signatures
