Re: future of IDS

[NetSurfer <netsurf () sersol com>]

I put a small shared hub behind the Pix for sniffing/monitoring and one
(sacrificial) between the Pix and the gateway router to watch the dmz.  

On Thu, 15 Oct 1998, Colin Campbell wrote:

From: Colin Campbell <sgcccdc () citec qld gov au>
To: firewall-wizards () nfr net
Subject: future of IDS

Hi,

(may show some ignorance here so be gentle :-)

Our firewall sits between two networks. The "external" houses lots of
internet-visible web servers, much as one would expect. The internal net
houses intranet servers. Up until recently, these nets were just plain old
hubs. They also suffered from consistent 10% collision rates. Everyone was
hurting.

Consequently, we replaced these hubs with switches. Network performance is
great. No collisions, the machines that can talk at 100Mb do, all is well
with the world. Well, almost. I tried snooping some traffic between two
machines and when I saw nothing, the difference between hubs and switches
suddenly dawned on me.

Now, after all this preamble, I do actually have a question for the great
minds to ponder. With the likelihood that more and more hubs are going to
disappear and be replaced by switches, where does that leave the humble
IDS that can no longer see all the traffic it needs to, to do its job?

Colin





--
James D. Wilson
http://www.pixi.com/~netsurf/
"non sunt multiplicanda entia praeter necessitatem"
    William of Ockham (1285-1347/49)