Re: future of IDS

[Adam Shostack <adam () homeport org>]

On Fri, Oct 16, 1998 at 10:31:36AM -0700, Tupshin Harper wrote:
| 2) With the reality of GB LAN networking nearing the mainstream, has
| anybody(switch vendor or other) speculated on having for example a 10/100MB
| switch that has a GB port that can spit out all traffic on all ports for
| monitoring?  Would seem like an ideal solution for the security conscious.


        I don't think sniffing traffic is part of my ideal network
configuration.  A single point of failure of compartmentalization is
not something I want to install.

        Since others have mentioned hardware trends, let me throw in
another monkey wrench, which is crypto.  When I can route everything
over ssh or IPsec, your network sniffer becomes a traffic analysis
tool, and then keeping up with gigabyte streams is a lot easier.

Adam