Re: Intrusion Detection Recommendations

[Gary Flynn <flynngn () JMU EDU>]

Mike Radomski wrote:
> Hello,
> We are currently looking at different alternatives to our Snort
> implementation for and IDS.  We currently run Snort+ACID on a SPAN port.
>  It works well, but would like a more robust system that is capable of
> anomaly detection, flow analysis, etc.  I am wondering what everyone
> uses for IDS/IPS?  Do you use a combination of open source tools, a
> commercial software solution, or a commercial hardware solution?  What
> are the advantages of your implementation?  Disadvantages?

We installed Netscreen/Juniper IDPs 16 months ago on
our Internet border and have been very happy with the
functionality they provide. It is so much more
efficient to have recognized attacks (IE exploits,
IM exploits, IIS exploits, etc.) stopped at the border
rather than just being reported to us.

--
Gary Flynn
Security Engineer
James Madison University