Re: IPS and Trunking

That isn't a feature of the IDS, it's a feature of the switch. The IDS just sniffs whatever passes by its network interface. This has been a common basic feature of most switches for years, usually using the term span port or mirror port.

There are some plusses and minuses with this approach as compared with the other popular alternative of using a network tap, e.g. it's cheaper, but you could run the risk of missing packets on busy switches where the total throughput exceeds the throughput of that switch port.

I'm not sure you would want to do this with an IPS. IPS functionality requires that traffic pass through it, e.g. that it be installed inline on just one network segment, or else it will be unable to reliably stop traffic e.g. "prevention." IDS/IPS can attempt to stop threats via "active response" where for example a spoofed TCP Reset packet is sent to try to close the connection, but this is not guaranteed to always work, and you want to enable it sparingly to avoid having false positives shutting down legitimate traffic. On the other hand, inline IPS typically means you can monitor and protect fewer connections, which means more devices and more money compared to IDS spanning multiple networks.


kind regards,
Karl Levinson
http://securityadmin.info

------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw
to learn more.
------------------------------------------------------------------------

Relevant Pages

  • IDS Feature Request List (including potential new requests).
    ... I have updated the IDS Feature Request List ... I suppose a blade could allocate some per-session memory and track ... XPS has some nice features that IDS could do with e.g. ...
    (comp.databases.informix)
  • Re: UK IUG Meeting
    ... IDS HDR secondary server allows read access, ... How does Informix's feature set of replication ... and HA compare with DB2 HADR? ... > - DB/s and IDS Development Labs are seperate but can share ideas. ...
    (comp.databases.informix)
  • Re: Thinking Green.. yeah I know ... ironic... :-)
    ... Obnoxio The Clown wrote: ... Let's shift outside the IDS box for just .02 quantums if you can. ... you may as well ask where all the IDS features in DB2 are. ... I've been involved recently in a discussion about a very small feature that should have been put long, ...
    (comp.databases.informix)
  • Re: Informix beats Oracle
    ... What's the difference between that and this new feature? ... Using this, you won't block when trying to read a row that has a lock. ... Oracle is a versioned RDBMS like Postgres and I believe some engines used in mySQL. ... I'll be very happy if my daily customer migrates to IDS 11 and I can use this feature. ...
    (comp.databases.informix)
  • Re: [PATCH 0/4] - v2 - Object creation with a specified id
    ... should keep on using some of its ids (such as its process id, or sysV ipc ids). ... This patch provides a feature that can help ensuring this saved state reuse: ... next object to be created will have its ids set to XX0, ...
    (Linux-Kernel)