Re: Fw: Promiscuous vs Inline IDS

["Dener L. Martins" <613494596 () brt14 com>]

Hi,

One good option is using a passive optical tap for Gigabit links. The 
latency introduced is minimum, and you can retrieve the alarms via 
another port (Fast Ether.), through another path. Inline is good when 
you want to create a "sub-DMZ" of boxes protected inside an Intranet, or 
inside another DMZ behind a firewall. The peak traffic must taken into 
consideration when dimensioning the box and its netwk interfaces.

dener
.......................
Mustapha Huneyd wrote:
> I was wondering if there are tests conducted to show traffic (bottleneck)
> patterns for both INLINE & Promiscuous IDS. Also are there tests that
> highlight differences or similarities in capture patterns for both kinds of
> IDS? Basically I want to know if an Inline IDS would create a bottleneck in
> a Fast ethernet / GE network?.
>
> For e.g. SNORT inline vs ISS Realsecure or Cisco IDS
>
> Mustapha
>
>
> -------------------------------------------------------------------------------
> Can you respond to attacks based on attack type, severity, source IP,
> destination IP, number of times attacked, or the time of day an attack
> occurs? No? 
> No wonder why you're swamped with false positives! 
> Download a free 15-day trial of Border Guard and watch your false
> positives disappear.
>
> http://www.securityfocus.com/StillSecure-focus-ids2
> -------------------------------------------------------------------------------



-------------------------------------------------------------------------------
Can you respond to attacks based on attack type, severity, source IP,
destination IP, number of times attacked, or the time of day an attack
occurs? No? 
No wonder why you're swamped with false positives! 
Download a free 15-day trial of Border Guard and watch your false
positives disappear.

http://www.securityfocus.com/StillSecure-focus-ids2
-------------------------------------------------------------------------------