Re: IDS

[Matt.Riddell () madison co nz (Matt Riddell)]

-={> I think the simplest solution is an IDS on a dedicated machine.
-={>
-={> e.g.: ISS Real Secure Engine + Monitor
-={>
-={> What do you think about ??

-={The "network engine" (sensor) is better left alone and it is probably
-={wiser to have to monitor/console application run on a separate server.
-={Otherwise your GUI and DB queries will slow down the (busy) sensor and
-={possibly increase your dropped packets.

only problem with that is you can end up with situations where your IDS
drops packets and your server doesn't or the reverse.

Matt