IDS

[slicardie]

Hi guys,

Which are the better commercial/free IDS packages available?

 

[rwullems]

snort or black ice defender (now ISS BlackIce PC protection) or are you looking for a more wide approach using network sensors and a central alerting/management server?

 

[slicardie]

That's right rwullems, a wider approach is what I'm looking for.

 

[rwullems]

still,
one option will be iss, check iss.net
regards,
Robert

 

[AZeemeri]

IDS & IPS

http://www.nai.com/us/products/sniffer/network_ips/category.htm

 

[rwullems]

i know, we are a reseller for this stuff...........

 

[MichealC4]

For IDS, I highly recommend Snort. We are running it at our college right now. There are others, I just haven't played with them a whole lot. For IPS, we are currently looking at Tippingpoint Technologies. We have also talked to StillSecure, ISS (which they never bothered to return my phone calls, go figure), and have looked briefly at LucidSecurity.

Understand that IDS is _only_ detection, it does not stop attacks. IPS stops attacks and does logging for forensics. I have some resources for information if you want them.

----------------------------
I am Comptia A+ Certified

 

[rwullems]

if you're looking for something to read about IDS'es, read the following, published by Robert Graham (former CTO of Network ICE, now working for ISS)

http://www.robertgraham.com/pubs/network-intrusion-detection.html

regards,
Robert

 

[slicardie]

TechiMicheal,

In fact I dowloaded Snort, but I haven't had time to test it yet... I'll try it as soon as I can. In the meantime, I ran Languard. I know it is not an IDS or IPS, but it can tell you some of the weaknesses in your LAN.

rwullems,

The article is very good! I will print it and read it at home