OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: Intrusion Detection Logfile Software
From: Ron Gula (rgulaNETWORK-DEFENSE.COM)
Date: Tue Oct 10 2000 - 18:12:42 CDT

At 06:43 PM 10/10/00 -0400, you wrote:
>> If your pocketbook is thin, you can go for the obvious no-cost solution of
>> Snort+aracNIDS?
>
>What reasons would there be _not_ to go with this solution?

These reasons could depend on the network technology involved.

Snort is a great open-source Network IDS. What the original question
was though was for a web log and firewall log monitor. Run a web-SSL
attack and most NIDS don't report anything. Place the firewall in front
of the NIDS and the NIDS may not see port scans. If you have a Nokia
firewall with a built in CSU/DSU T1 interface, then you may not get
the chance to put a NIDS in front of the firewall.

Ron Gula
VP IDS Products
Enterasys Networks
http://www.enterasys.com
http://www.securitywizards.com