Right now we really dont have anything and my manager asked me to look into it. what do you guys use or recomend?
Printable View
Right now we really dont have anything and my manager asked me to look into it. what do you guys use or recomend?
SNORT.
In fact, I just wrote a paper on expanding the role of snort in our enterprise this morning. www.snort.org
Have you read TheHorse13' tuts on Nmap? That's where I'm starting from. Don't know much yet myself, though I do know the above mentioned SNORT is quite popular.
I know very little about this but will be looking into snort, Tripwire, Toplayer, Internet Security systems, and net screen
Knight....Nmap is basically a scanner it is not an IDS (Intrusion Detection System).Quote:
Originally posted here by AngelicKnight
Have you read TheHorse13' tuts on Nmap? That's where I'm starting from. Don't know much yet myself, though I do know the above mentioned SNORT is quite popular.
Cheers:
SNORT as a NIDS.
Learn a little about Network Intrustion Detection solutions here.
thanks for the info guys!
I knew that...I was just...making sure you knew that... ;)Quote:
Knight....Nmap is basically a scanner it is not an IDS (Intrusion Detection System).
Thanks for setting my straight there. 3ntropy's paper helped too. So port scanning for intrustions an IDS does not make, got it.
Before even considering an IDS there are many other things that you will want to think about. deploying an IDS is not as simple as installing snort, configuring it and then letting it go. There are many, many factors involved and none are to be overlooked. Head over to http://www.security-focus.com for more info. They have a large database covering any questions you would have.
I've worked with Snort on and off when dealing with network's and I think that one of Snort's best qualities is it's log file's and the management/monitering of them. You need to constantly moniter your log file's in order for it to work correctly and efficiently.
We use a combination of stuff here currently. Right now it is NFR (Network Flight Recorder) 6.1 and Snort 2.x on a few different boxes.
I have written a plan to migrate from NFR to Demarc Sentarus in the near future, but I will probably still be using Snort on our internal network. I'm looking more for IPS on our external to internal connections and Snort just won't do that... plus we move so much traffic that two of the snort boxes we had watching one of our internet connections just up and died after a couple of minutes. The NFR's are klugy but can handle the traffic demands. :)