RE: IPS technology question.

From: Swift, David (dswift_at_ipolicynetworks.com)
Date: 08/24/05

  • Next message: Israel: "IDS with Case-Based Reasoning"
    Date: Wed, 24 Aug 2005 07:35:38 -0700
    To: "planz" <planz2009@gmail.com>, "snort user" <snort.user@gmail.com>
    
    

    There are varying techniques in achieving performance, and FPGAs/ASICs
    are not the only way.

    The company I work for, iPolicy Networks, put the development effort on
    the front end to optimize rules, signatures, and processing rather than
    building a better ASIC. We've been able to achieve 140Mbps - 2Gbps on a
    single standard Intel platform without FPGAs by pre-compiling the rules
    into a state engine, and pushing them down to an Intel platform.

    On the high end to reach 4Gbps we used clustered Intel Network
    Processors. Again, no custom ASICs required, just intelligent parallel
    processing, and pre-compilation with bounded rules.

    As to the total number of vendors, Gartner said last year there were
    over 700 vendors in the security space. And it seems everyone messages
    the same thing whether or not they can do it.

    -----Original Message-----
    From: planz [mailto:planz2009@gmail.com]
    Sent: Tuesday, August 23, 2005 9:14 PM
    To: snort user
    Cc: focus-ids@securityfocus.com
    Subject: Re: IPS technology question.

    I don't get, what do you mean by "Percentage", since we have uncounted
    number of vendors/brands of IPS today.

    If you look at the technology angle, the vendors who are offering both
    Software and Appliance versions of the same IPS, falls into the first
    category. To take a look back at the market, we find only very few
    vendors, like ISS, Snort, Dragon, ...hmmm.. Can somebody help to
    fill-up the list.

    Whether it is IDS or IPS, it is important to look at the Detection
    Technology. If it cannot detect, how can it alert or prevent?

    In an IPS world, firewall plays behind the scenes; since the IDS is
    configuring the built-in firewall feature to block.

    snort user wrote:

    >Greetings.
    >
    >What percentage of the IPS systems are out there, which does not use
    >co-processors/FPGA etc..
    >
    > What percentage of the IPS systems depend on firewalls like iptables
    >and ip filter ?
    >
    >I am just trying to get an idea of what is the state of art in the IPS
    >technology space.
    >
    >Any information is appreciated.
    >
    >Thanks
    >
    >-----------------------------------------------------------------------
    -
    >Test Your IDS
    >
    >Is your IDS deployed correctly?
    >Find out quickly and easily by testing it
    >with real-world attacks from CORE IMPACT.
    >Go to
    http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
    >to learn more.
    >-----------------------------------------------------------------------
    -
    >
    >
    >
    >

    ------------------------------------------------------------------------
    Test Your IDS

    Is your IDS deployed correctly?
    Find out quickly and easily by testing it
    with real-world attacks from CORE IMPACT.
    Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708

    to learn more.
    ------------------------------------------------------------------------

    ------------------------------------------------------------------------
    Test Your IDS

    Is your IDS deployed correctly?
    Find out quickly and easily by testing it
    with real-world attacks from CORE IMPACT.
    Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
    to learn more.
    ------------------------------------------------------------------------


  • Next message: Israel: "IDS with Case-Based Reasoning"

    Relevant Pages

    • RE: Intrusion Prevention Systems - New Generation (new technologi es)
      ... Most of the current intrusion detection techniques/technologies are not ... These kinds of capabilities will provide good IPS. ... I still consider IDS an immature technology. ... In reality, BlackICE Guard (now ...
      (Focus-IDS)
    • RE: Intrusion Prevention Systems
      ... It seems were calling an reactive IDS and IPS. ... In reality, BlackICE Guard ... IPS is hardly a "test lab device" or unproven technology. ...
      (Focus-IDS)
    • Re: IPS, alternative solutions
      ... I have the impression that some of the alternatives to IPS you mentioned ... Parts of the market have matured (network ... implementations (in-line protocol decoding and blocking/active response ... an often deployed technology at this time is ...
      (Focus-IDS)
    • RE: How to choose an IDS/FW MSS provider
      ... When I say "old hat" I am not disparaging the technology or vendors in any ... I donít think IPS is going to curl up and die at the ... aware of who are talking with switch manufacturers on this very topic. ...
      (Focus-IDS)
    • Re: How to choose an IDS/FW MSS provider
      ... Protecting the core from ... > the distribution layer and workstations from other workstations is next. ... > already have some IPS vendors rushing in this direction. ... what "old hat" technology are you referring to? ...
      (Focus-IDS)