Re: IDS outside of firewall?

["Ryan Russell" <ryanr () sybase com>]

> Are there advantages to putting an IDS on the outside of the firewall?

As you mentioned, so you can log stuff that the firewall doesn't
(perhaps bug...perhaps doesn't think it's suspicious...)

And also so you can identify paticular attacks, rather than
connection attempts.  Since the firewall most likely won't (you hope)
allow handshake to even complete, you'll see relatively few
"attacks"... they won't be able to handshake enough to get
an attack signature... but you might see a few.

Say... single packet stuff.. like malformed DNS queries or answers,
SNMP packets.... Stuff that an IDS will log as "attempted DNS
blow-your-stack attacks" whereas the firewall might say
"dropped UDP port 53."

                         Ryan