Re: IDS and Bandwidth

[Fergus Brooks <fergwa () gmail com>]

Is it possible for you to find out how much the mean traffic is coming
to the central node from the various distributed nodes?

What flavour of IDS are you using, and on what platform?


On 7/5/05, Tony Rall <trall () almaden ibm com> wrote:
> On Tuesday, 2005-07-05 at 03:46 GMT, bhaskar.gupta () tcs com wrote:
> > I am working as an IDS operator in my company. Due to big size of the
> > organisation, different IDS nodes are monitoring different centers
> through a
> > central master node. Since there are lot of incidents ( including false
> > positives ) generated across the organsation, there is a complaint from
> our
> > networking team that IDS is consuming lot of bandwidth over networking
> >
> > I am really not able to figure out how much IDS can eat up network
> bandwidth.
>
> If you were mirroring all traffic to a central IDS for analysis, that
> could easily consume all available bandwidth.
>
> If you are only forwarding detected positives to the central site, that
> should normally be less than 1% of the monitored traffic on individual
> remote links.  Only if you had extremely many remote links or relatively
> low bandwidth into your central site should this result in a significant
> load on the central links.
>
> Tony Rall
>
> --------------------------------------------------------------------------
> Test Your IDS
>
> Is your IDS deployed correctly?
> Find out quickly and easily by testing it with real-world attacks from
> CORE IMPACT.
> Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
> to learn more.
> --------------------------------------------------------------------------

--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
--------------------------------------------------------------------------