Re: future of IDS

["Owen O'Connor" <owenc () panix com>]

On Fri, 16 Oct 1998, Martin W Freiss wrote:

> ... where the capture engine is in the firmware of the switch (hey, free
> product idea for the rest of you :-)). Tough for statistical analysis,
> should be doable for more signature based IDSes.

ISS for one have been talking about exactly this for quite some time. See
for example http://www.iss.net/prod/tpo/rs_faq.html. ODS are jumping in
bed with a number of NIDS vendors to put agents on the switch, see
http://web.ods.com/ for details. I seem to recall that Cisco are talking
about putting their NIDS product onto a Cisco blade for use in all your
boder (and possibly interior) routers. This IMHO is where an IETF standard
on data transfer would be useful.

Owen O'Connor