Bugtraq mailing list archives
Re: fragroute vs. snort: the tempest in a teacup
From: "Steven M. Bellovin" <smb () research att com>
Date: Fri, 19 Apr 2002 16:01:21 -0400
In message <200204182210.IAA10429 () caligula anu edu au>, Darren Reed writes:
IMHO it makes little sense for an IDS to be *behind* a firewall as it's going to miss out on lots of useful data points.
The question to answer is what the purpose is of your IDS. If you're a researcher on intrusion techniques, you should indeed have your IDS on the outside. If you're a good citizen and have lots of free time, by all means have one, so you can tell all the rooted sites that are probing you that they're owned. But if you want to find out if you're under attack, don't bother -- you are under attack, more or less continuously. An IDS on the inside will have many fewer false alarms, and will tell you what you really want to know -- that someone has gotten through your (other) defenses. --Steve Bellovin, http://www.research.att.com/~smb Full text of "Firewalls" book now at http://www.wilyhacker.com
Current thread:
- fragroute vs. snort: the tempest in a teacup Dragos Ruiu (Apr 18)
- Re: fragroute vs. snort: the tempest in a teacup Dug Song (Apr 18)
- Re: fragroute vs. snort: the tempest in a teacup Darren Reed (Apr 18)
- Re: fragroute vs. snort: the tempest in a teacup Ron DuFresne (Apr 20)
- Re: fragroute vs. snort: the tempest in a teacup Darren Reed (Apr 18)
- <Possible follow-ups>
- Re: fragroute vs. snort: the tempest in a teacup Steven M. Bellovin (Apr 19)
- Re: fragroute vs. snort: the tempest in a teacup Brad Powell (Apr 19)
- Re: fragroute vs. snort: the tempest in a teacup jan (Apr 20)
- Re: fragroute vs. snort: the tempest in a teacup Dug Song (Apr 18)