Re: Comparison question

[David Glosser <david_glosser () yahoo com>]

I believe the sonicwall will only pick up stuff coming from the internet...
(Shaun, will it also pick up outbound nasties?)

-With the right switch or Ethernet tap, you can monitor your internal
servers and network devices. So if a user is doing something naughty
(whether they know it or not, I'm thinking of malware here), you will pick
it up.

-With the bleeding snort rules, you should pick up the latest and greatest
malware infections and "0day" stuff.

I know there's a saying for this... "defense in depth"... "layered approach"
... "soft chewy center"  ... anyway, it's best to run both.

I'd be surprised if snort doesn't pick up something that the sonicwall
missed.  And I'd be very interested if you can come back and say "the
sonicwall was the greatest thing since sliced bread."

If you do set up a snort box, please let us know how well the sonicwall did.
I have a few and it would be informative to know if I should push for the
IDS/IPS license. Thanks


----- Original Message ----- 
From: "Eric Hines" <eric.hines () appliedwatch com>
To: <ste () smxy org>; <snort-users () lists sourceforge net>
Sent: Monday, February 28, 2005 12:34 PM
Subject: RE: [Snort-users] Comparison question


> 1) With open source Snort, you're not bound to any costly licensing
> restrictions like you would be with the Sonicwall. E.g. if you wanted to
> deploy additional Snort installations around your network, all you'd have
to
> do is lynx to www.snort.org rather than calling someone to order
additional
> sensors.
>
> 2) Also, Snort and its signature language are in much greater use and more
> popularly supported than say the proprietary rules language of Sonicwall,
> NFR (NCODE), etc or any other commercial IDS vendor that doesn't use
Snort's
> signature syntax. I suppose a shift is happening in the commercial vendor
> space where vendors are now looking to or have already added support for
> Snort's language (e.g. ISS and their addition of TRON). So when hiring a
new
> IDS analyst, its going to be a far easier finding someone who used Snort
at
> home or the office rather than trying to sift through resumes of people
> looking for someone whose used Sonicwall's IDS. Also, notice that when
> Symantec and the other AV companies that release a whitepaper on a new
worm,
> they'll typically include a Snort signature(s) for detection.
>
> 3) Price! Snort == free. Sonicwall == $$$
>
> 4) I am unaware of Sonicwall's ID and IPS capabilities, however, Snort
> obviously having protocol anomaly detection, stateful pattern detection,
and
> other capabilities as an IDS etc.. Also, with the latest 2.3 of Snort,
users
> have the capability to also go inline in addition to its use of flexresp
for
> passive IPS through shunning.
>
> 5) How confident is the company running a stateful packet inspection
IDS/IPS
> on the same system routing traffic in/out of your network at the
perimeter?
> Separation of duties please :)
>
> Just my 2 cents. Take it as you will. I hope it helps you in providing a
> good argument to the powers that be.
>
>
>
> Best Regards,
>
>
> Eric Hines, GCIA, CISSP
> CEO, President, Chairman
> Applied Watch Technologies, LLC
> 1134 N. Main St.
> Algonquin, IL 60102
> Tel: (877) 262-7593 x327
> Fax: (877) 262-7593
> Web: http://www.appliedwatch.com
> "Browserless, Enterprise Snort Management"
>
>
>
> -----Original Message-----
> From: snort-users-admin () lists sourceforge net
> [mailto:snort-users-admin () lists sourceforge net] On Behalf Of Shaun T.
> Erickson
> Sent: Sunday, February 27, 2005 7:24 PM
> To: snort-users () lists sourceforge net
> Subject: [Snort-users] Comparison question
>
> First, I'm not trying to start a religious war. I'm just looking for
> information to educate myself with, so I can make the best decision for
> *my* organization. That said ...
>
> I am wondering if anyone can give me any idea as to how well, or not, a
> Snort installation (of whatever is latest) would compare to using the
> IDS/IPS features of my SonicWall firewall (a Pro 4060, running their
latest
> firmware). I have the firewall, with those features licensed. I could set
up
> Snort. I'm trying to decide the merits of either decision.
>
>     -ste
>
>
> -------------------------------------------------------
> SF email is sponsored by - The IT Product Guide Read honest & candid
reviews
> on hundreds of IT Products from real users.
> Discover which products truly live up to the hype. Start reading now.
> http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
>
>
> -------------------------------------------------------
> SF email is sponsored by - The IT Product Guide
> Read honest & candid reviews on hundreds of IT Products from real users.
> Discover which products truly live up to the hype. Start reading now.
> http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users



-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users