RE: Firewall and IDS, (the second way).

[PJD () portcullis-security com]

> If you want your sensor to be non-invasive and undetectable, it's highly
> suggested that you use a special device, like the Shomiti (now Finisar)
> Century TAP:
>
> PROS: full duplex support, fault tolerant, non-invasive network
> monitoring, undetectable, useful for switched environments (there's no
> longer need for a span port).
>
> CONS: it's expensive for small environments.
Then you also have to consider the so called Stealth mode, which is more
typical of a hubbed (perhaps smaller) environments, where no IP address is
assigned to the interface, this makes it non addressable but still available
for promiscious mode hence IDS. In this mode the device should not respond
to probing such as crafted multicast packets, and as its interface is not
defined it would also not know its nameserver addresses so not attempt DNS
queries.