stealth ports and IDS

[James X <scouser () paradise net nz>]

When configuring IDS boxes my preference has always been for snort
running on a solaris sparc box.

For cost reasons I would like to use a non proprietry platform. Lets
face it Sun hardware is damn expensive.
One stumbling box has been the idea of a stealth port.  I usually
operate my IDS boxes with the interfaces in stealth mode ie no IP
address or stack. I do not know of a way of acheiving this using linux
or netBSD etc.. and without it I would feel rather vulnerable. To help
mitigate it I am looking at hardware network taps (read only). These
could be the answere but are not that cheap (kind of the whole idea).
What are peoples opinions ?

_______________________________________________
firewall-wizards mailing list
firewall-wizards () honor icsalabs com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards