[Snort-users] Re: fragroute vs. snort: the tempest in a teacup

Steven M. Bellovin smb at ...5665...
Mon Apr 22 14:28:53 EDT 2002


In message <200204182210.IAA10429 at ...5647...>, Darren Reed writes:
> IMHO it makes little sense
>for an IDS to be *behind* a firewall as it's going to miss out on lots
>of useful data points. 

The question to answer is what the purpose is of your IDS.  If you're a 
researcher on intrusion techniques, you should indeed have your IDS on 
the outside.  If you're a good citizen and have lots of free time, by 
all means have one, so you can tell all the rooted sites that are 
probing you that they're owned.  But if you want to find out if you're 
under attack, don't bother -- you are under attack, more or less 
continuously.  

An IDS on the inside will have many fewer false alarms, and will tell 
you what you really want to know -- that someone has gotten through 
your (other) defenses.

		--Steve Bellovin, http://www.research.att.com/~smb
		Full text of "Firewalls" book now at http://www.wilyhacker.com






More information about the Snort-users mailing list