Network hardware IPS

[Alvin Wong <alvin.wong () b2b com my>]

Hi,

I'm interested to find out if anyone can share their experiences or
recommend a network hardware IPS that is deployed in front of the
gateway which is able to detect attack signatures and at the same time,
actively blocking out these attacks, alerting me in the process. 

This would be different from a passive IDS which depends on correlating
the logs every time an alert pops up. An ideal solution would be to be
able to detect the patterns and prevent them automatically, can a
network IPS do this?

I understand that it is possible in some IDS to do a TCP reset after one
had confirmed that the connection is not acceptable, can anyone explain
whether an IDS that can do this be actually "active" as opposed to
passive?

It would also be interesting if there could be some amount of trend
analysis built in which can review the destination/source ip traffic
over time, which can be used to identify particular boxes which are
easily targeted, which would mean that more work needs to be done for
that box.

Regards,
Alvin



---------------------------------------------------------------------------
Captus Networks IPS 4000
Intrusion Prevention and Traffic Shaping Technology to: 
 - Instantly Stop DoS/DDoS Attacks, Worms & Port Scans
 - Automatically Control P2P, IM and Spam Traffic
 - Precisely Define and Implement Network Security & Performance Policies
FREE Vulnerability Assessment Toolkit - WhitePapers - Live Demo 
http://www.securityfocus.com/sponsor/CaptusNetworks_focus-ids_000101
---------------------------------------------------------------------------