Snort mailing list archives
Re: Naming convention of Snort
From: Jason Hammerschmidt <Jason.Hammerschmidt () maclaren com>
Date: Wed, 13 Mar 2002 14:22:35 -0500
So then what's the difference between a HIDS in promiscous mode (with tap/mirroring/etc), and a NIDS, furthermore using a tap/mirroring you're in effect trusting your networking gear to do a lot of things... trusting it to follow IEEE 802.x standards (and how often have we seen this violated?), trusting it not to fail in even the slightest way, trusting it to handle congestion (what if packets get dropped on your mirrored port), trusting the software of the switch. You're not garanteed 100% of your network traffic, or at least you can't be certain 100% is getting through. In paranoid circles wouldn't GIDS be the only true 100% NIDS? I've been taught never to trust port mirroring/VLAN's/all that jazz of switches if your intention is to be highly secure. I believe there's even something in the FAQ in length about the various traps of setting up Ethernet taps/mirroring. In my opinion you cannot trust such setups for intention of a NIDS. PS. I'm only asking these questions as a semantics inquiry, I'm not meaning to start any wars. Just feeding my curiosity. On March 13, 2002 01:32 pm, Chris Green wrote:
Jason Hammerschmidt <Jason.Hammerschmidt () maclaren com> writes:Why name Snort a NIDS when it's really a Host based IDS..It is a NIDS. Host Based IDS generally refers to monitoring Host based events such as process activity or the like.
-- Jason Hammerschmidt - direct: 416.643.8560 "Whatever you do will be insignificant, but it is very important that you do it." --Mahatma Gandhi _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Naming convention of Snort Jason Hammerschmidt (Mar 13)
- Re: Naming convention of Snort Chris Green (Mar 13)
- Re: Naming convention of Snort Erek Adams (Mar 13)
- <Possible follow-ups>
- Re: Naming convention of Snort Jason Hammerschmidt (Mar 13)
- Re: Naming convention of Snort Erek Adams (Mar 13)
- Re: Naming convention of Snort Leigh David Heyman (Mar 13)
- Re: Naming convention of Snort Chris Green (Mar 13)
- Re: Naming convention of Snort Erek Adams (Mar 13)
- Re: Naming convention of Snort counter . spy (Mar 13)
- RE: Naming convention of Snort Bob Walder (Mar 13)