RE: NEW TO IDS

[broyds () home com (Bill Royds)]

You asked:
         1) does ids monitor IP traffic or they do monitor IPX and SNA traffic 
     for loopholes  too.
Generally most Network IDS systems monitor only IP since that is the most prevalent traffic but since IPX and SNA are 
also carried over Ethernet then an Ethernet sniffer based IDS can listen to other protocols. Some IDS do recognise IPX 
including Axent's NetRecon. You need to ask that question of the various vendors. It is mostly a design decision rather 
than being limited by hardware.

         one solution is to put ids between internet router and firewall, I 
     know it will monitor a lot of traffic and might generate false alarm 
     but is it the only possible way.

IDS is a kind of burglar alarm.  You would put a business burglar alarm on front door, but also by you accounting 
office and safe and any other important assets. Many IDS have separate sensor programs that one deploys all over the 
network with a central monitoring station to integrate the information. This allows one to place the sensors where 
needed but to have a single control console. This console can often integrate with a firewall as Axent does with its 
Raptor-NetRecon-NetProwler.

  Since many Firewalls and IDS output their logs in syslog format, they can be combined by tools like Perl as well as 
other more specialised packages.

-----Original Message-----
From: owner-ids () uow edu au [mailto:owner-ids () uow edu au]On Behalf Of
kbashir () engro com
Sent: Thursday, December 16, 1999 00:49
To: ids () uow edu au
Subject: IDS: NEW TO IDS

     I wanted to find out a couple of things.
     
     
     1) does ids monitor ip traffic or they do monitor ipx and sna traffic 
     for loopholes  too.
     
     2) basically i want to find how to monitor internet traffic with ids. 
     is the below solution good or bad.
     
     i know i can integrate the firewall logs with the ids in market but if 
     you have a firewall which doesnt have this capability how can u do 
     this.
     
     one solution is to put ids between internet router and firewall, i 
     know it will monitor a lot of traffic amd might generate false alarm 
     but is it the only possible way.
     
     kb