Re: future of IDS

[Martin W Freiss <freiss.pad () sni de>]

Bennett Todd writes:
> My own prediction is that we're going to see a strong trend towards a new
> archicture (supposedly available or at least under development for the
> commercial NFR, at least), where the IDS is partitioned into capture and
> analysis engines, and the capture engine is designed to be replicated over as
> many hosts as needed.

... where the capture engine is in the firmware of the switch (hey, free
product idea for the rest of you :-)). Tough for statistical analysis,
should be doable for more signature based IDSes.

-Martin

--
 Martin Freiss, MF194        | freiss.pad () sni de | http://www.rmi.de/~marvin
 Siemens ICN VD IT NET Consulting, Solution Team Internet / Intranet
Half male, half e-mail.