Re: Important Comments re: INtrusion Detection

[Steve Bellovin <smb () research att com>]

         There are still problems that need to be solved here. The most
         obvious is that the IDS is no longer "unobtrusive", and it can
         actually bottleneck the network, unlike ID systems (which,
         when bogged down, simply fail to work reliably). There are
         also subtle problems at the protocol level, such as end-to-end
         acknowledgement. However, the firewall community has made this
         work; I'd be surprised if the IDS community couldn't too.

The most serious problem, of course, is that there is no a priori reason
to think that the IDS's stack is bug-free.  And if you penetrate it, you've
acquired control of a machine that is by definition a perfect sniffer --
for the dark side...