Re: Cisco NetRanger

[gshipley () neohapsis com (Greg Shipley)]

On Mon, 4 Oct 1999, Johann van Duyn wrote:

> Does anyone here have much experience with Cisco's NetRanger? Any thoughts
> on its effectiveness, especially compared to Axent IntruderAlert, CyberCop,
> or any other products out there?
>
> Any information gained from hands-on experience would be welcomed,
> especially if you are able to compare it to other stuff out there.

I've got the following up in our lab, right now, for the Nov 15th story on
Intrusion Detection in Network Computing magazine (http://www.nwc.com):

Intruder Alert
NetProwler
NetRanger
Cisco IOS IDS build (on a 2621 router)
BlackICE
NFR
RealSecure
Centrax
Dragon
CMDS (from ODS)

and my question, before I can fully answer yours, is what are you looking
for?  It has become REALLY obvious in our testing that purchasing/building
an effective ID solution is highly dependent on what EXACTLY you need it
to do.

Axent's Intruder Alert is host-based, and doesn't cover the same things as
NetRanger (which is network-based).  Axent's NetProwler is more
comparable to NetRanger, but approaches it a little differently (and is
REALLY chatty!)

NFR and Dragon aren't as polished, but are fairly customizable.
RealSecure can combine host and network based, etc.....lots o differences.
Can you give me more info?

-Greg