Re: future of IDS

[Bennett Todd <bet () mordor net>]

1998-10-15-12:24:24 Colin Campbell:
> [...] With the likelihood that more and more hubs are going to disappear and
> be replaced by switches, where does that leave the humble IDS that can no
> longer see all the traffic it needs to, to do its job?

Interesting question. Different folks will come up with different answers, I'm
sure.

My own prediction is that we're going to see a strong trend towards a new
archicture (supposedly available or at least under development for the
commercial NFR, at least), where the IDS is partitioned into capture and
analysis engines, and the capture engine is designed to be replicated over as
many hosts as needed.

-Bennett