Re: Important Comments re: INtrusion Detection

["Marcus J. Ranum" <mjr () nfr net>]

> > One other big win that Darren Reed identified at Usenix was that a proxy
> > IDS can't drop packets. You can't overload it and sneak packets past that
> > way. If the IDS can't read the packet, it doesn't get proxied. 

Now *THAT* sounds like the mythical Next Breakthrough in firewalls.

mjr.
--
Marcus J. Ranum, CEO, Network Flight Recorder, Inc.
work - http://www.nfr.net
home - http://www.clark.net/pub/mjr