[Snort-users] Re: fragroute vs. snort: the tempest in a teacup
Steven M. Bellovin
smb at ...5665...
Mon Apr 22 14:28:53 EDT 2002
In message <200204182210.IAA10429 at ...5647...>, Darren Reed writes:
> IMHO it makes little sense
>for an IDS to be *behind* a firewall as it's going to miss out on lots
>of useful data points.
The question to answer is what the purpose is of your IDS. If you're a
researcher on intrusion techniques, you should indeed have your IDS on
the outside. If you're a good citizen and have lots of free time, by
all means have one, so you can tell all the rooted sites that are
probing you that they're owned. But if you want to find out if you're
under attack, don't bother -- you are under attack, more or less
An IDS on the inside will have many fewer false alarms, and will tell
you what you really want to know -- that someone has gotten through
your (other) defenses.
--Steve Bellovin, http://www.research.att.com/~smb
Full text of "Firewalls" book now at http://www.wilyhacker.com
More information about the Snort-users