Re: Real Traffic (was Re: BlackICE IDS)

[tschroed () acm org (Trevor Schroeder)]

On Tue, 7 Dec 1999, Lance Spitzner wrote:

> I'm not saying having one single IDS system is the way to go.  But
> having a NID on every single network segment may hit the point of
> diminishing returns.

I agree... It's not so much the idea of having multiple NIDS across
multiple segments but multiple *diverse* NIDS operating in the *same*
environment and voting on what's occurring.

Of course the correlation must be automated or it's nearly worthless.
..........................................................................
: "I knew it was going to cost me my head and also my swivel chair, but  :
: I thought: What the hell--better men than I have risked their heads    :
: and their swivel chairs for truth and justice." -- James P. Cannon     :
:........... http://www.zweknu.org/ for PGP key and more ................: