On 12/9/05, <b class="gmail_sendername">Nathan C. Smith</b> <<a href="mailto:smith@ipmvs.com">smith@ipmvs.com</a>> wrote:<div><span class="gmail_quote"></span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
Anyone use anything? I'm not sold on the concept - maybe I don't understand<br>it. If you lock everything down it shouldn't be an issue should it? Don't<br>you want to know about new attacks that were/are successful?<br>
</blockquote></div><br>
If a bank locks their vault at night, why have a security camera? IDS
software can be really nice to keep an eye on your network; even if
there is no hacking. I've run both Snort and Bro. Snort was nice
because it was incredibly well supported and very well documented. Bro
(<a href="http://bro-ids.org/">http://bro-ids.org/</a>) is nice because rather than matching an exploit
string can watch for a regex, but the most valuable feature to me is
that it watches for "strange" traffic. SMTP/ssh/etc on odd ports,
strange tcp connection patterns, etc. Sometimes it sends me scrambling
after a Skype user by accident, but it does a pretty good job of
filtering alerts.<br>