Re: RE: IDS taps in a switched network

[rockie () apk net (R. Brockway)]

On Thu, 28 Oct 1999, David Newman wrote:

> --Some switches have a "spy port" that allows traffic to be redirected. This
> is really no better than a monitor hanging off a single port, since only one
> port at a time can be monitored.

not true, on ciscos you can have a span port which is the "spy" port, but
redirect entire VLANS to that port, not just traffic from one other port. 

> None of these approaches are IDS-specific. What we *really* need is for some
> big switch maker to run IDS code on an ASIC inside their switch. Any switch
> makers listening?

cisco (not to sound like an affiliate, cause i just use the equip alot)
has been toying with a mini IDS (catches MAYBE 45 recon signatures) in IOS
versions 12.0(5)T and greater with the Firewall Feature Set. Its not
great, but its a start, and that code can be easily written into their
switches. 

-rockie

--
R. Brockway                     APK Net Systems Administrator