Re: Cisco IDS

[Theodore Stout <theodorestout () yahoo com>]

Hello John,

Yeah I have used Cisco IDS.  In fact I used to sell
it.  I used to sell ISS RealSecure too.  Now I build
and Sell Snort as well as Sourcefire.

So, which is better?  I like Sourcefire a lot.  It is
easy to use and fun.  

After that, I am devoted to Snort.  Love it.  Great! 
Have it at home.

Following this, I have to say that Cisco IDS is good
in conjunction with the 65XX class of switches.  If
you need like +5Gig of throughput, this is a nice
solution.

However, I have always though that IDS should not be
deployed in this manner.  I suppose for a ISP, this
would be useful however I still do not think it is
smart due to system degregation problems.  Of their 1
gig devices, I do not think they have a better
solution than Sourcefire.

So I would go with Sourcefire if you have the bugdet
and want 250meg to 1 Gig throughput.  However, other
purposes, Snort is quite good.  Additionally, if you
don't have the skills to actually build Snort using
Fedora Core or OpenBSD, then using Sourcefire is my
suggestion since it is just so easy for normal Admins
to use.  However, if you got the skills, or your staff
has the skills, consider Snort as well.

It is also good pointing out that with Cisco, the
signatures really are dependant with your maintenance
contract with your vendor.  With Snort, you get that
stuff for free.

Hope that helps,

Theodore Stout, CISSP
CCSP, CCNP, CCIP 
ISS MSS Engineer
(Yeah I studied too much.....)

--- John Hally <JHally () epnet com> wrote:

> Hello Group,
>
>  
>
> Out of curiosity, has anyone had any experience with
> Cisco's IDS?  I'm
> curious how Snort stacks up in strengths/weaknesses
> including Sourcefire's
> commercial products.  
>
>  
>
> Thanks in advance!



                
__________________________________ 
Do you Yahoo!? 
The all-new My Yahoo! - Get yours free! 
http://my.yahoo.com 
 



-------------------------------------------------------
The SF.Net email is sponsored by: Beat the post-holiday blues
Get a FREE limited edition SourceForge.net t-shirt from ThinkGeek.
It's fun and FREE -- well, almost....http://www.thinkgeek.com/sfshirt
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users