Re: IDS and forensics

On January 27, 2003 03:11 pm, William Sykes wrote:
> I know it is not best practice to try to sell anything on this list but

<chuckle>

I guess I had better not be sending or receiving more than about a thousand packets per second then if I want to do any "forensic mining" without losing data. :-)

Well, maybe two if I shell out for a really expensive DB machine. :-) :-) :-P

I'm not knocking Oracle, it really is one of the finest SQL databases out there.... but wiring your NIC capture straight to Oracle is a bad idea. That 's why people started using IDSes....

cheers,
--dr

-- 
dr(at)kyx.net   pgp: 
http://dragos.com/ kyxpgp
http://cansecwest.com


-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: 
http://aris.securityfocus.com