best ids placement?

From: SB CH <chulmin2(at)hotmail.com>
Date: Thu Jun 26 2003 - 20:29:29 EDT

Hello, all.

I have read this document, subject is "Using Snort For a Distributed Intrusion Detection System" at
http://www.sans.org/rr/paper.php?id=352

according to this document, the proper placement say like this

The first example of the remote sensor placement is if you have a high-speed connection
to the Internet. You will want to monitor traffic coming from and going to that connection. The
best way to achieve this would be to place a hub between the border router and your firewall.

---

dummy hub placement between router and firewall or main switch like this?

                  router 

                     |

IDS ---------HUB 

                     |

                  Switch 

but another document say like this.
due to the limitation of shared media, this cannont be used if the connection between the switch and router is a full-duplex connection, as collisions will degrade the throughput.
and due to the limitation of shared media, it will increase the number of collisions impaction the flow of traffic between the router and switch.

What's the true and how did you set ids placement and what is the best? using taps? or span port? or hub?  

Thjanks for your opinions.

---

È®ÀÎÇÏÀÚ. ¿À´ÃÀÇ ¿î¼¼ ¹«·á »çÁÖ, ±ÃÇÕ, ÀÛ¸í, Àü»ý °¡À̵å http://www.msn.co.kr/fortune/default.asp

---

Attend the Black Hat Briefings & Training, July 28 - 31 in Las Vegas, the world's premier technical IT security event! 10 tracks, 15 training sessions, 1,800 delegates from 30 nations including all of the top experts, from CSO's to "underground" security specialists. See for yourself what the buzz is about! Early-bird registration ends July 3. This event will sell out. www.blackhat.com

---

Received on Fri Jun 27 14:08:57 2003