RE: IDS taps

["Clarke, Tyronne (Contractor)" <Tyronne.Clarke () dcma mil>]

My 2cts 

Network TAPS are sweet because: 
* Doesn't need a IP/Mac so the IDS or Sniffer is hidden to the network and better yet hackers 
* Taps do not require configuration and are generally passive and fault tolerant. 
* Taps operate on the signal level and do not recognize packets, sending faithful copies of actual packets, legal and 
otherwise.
* Taps provide dependable and complete data streams to the Intrusion Detection System. Security Engineers depend on 
complete data streams to recognize intruder patterns.Most Span/mirror hub combos only show you half of the conversation 
and drop critical packets
* Since Taps are inline they are not limited to the bandwidth of the Span port or switch

Also see link http://www.networkintrusion.co.uk/taps.htm

Datacom System's SINGLEstream(tm) 2000 is pretty sweet because you do not need the 2 nics and better yet you can hang 2 
full-duplex devices off of it. http://www.datacomsystems.com/datacom/prod/taps/eth/ss-2000.asp


Intrusion has a TAP roughly about the size of a pack of smokes http://www.intrusion.com/products/taps.asp 



-----Original Message-----
From: Carey Myers [mailto:cmlist170 () hotmail com]
Sent: Monday, October 04, 2004 2:17 PM
To: thanekamp () gmail com
Cc: security-basics () securityfocus com
Subject: IDS taps


Tim,

I know of a few TAP outfits

NetOptics:
http://www.netoptics.com
I have some hands-on experience with these.  Full duplex taps--splits data 
streams into RX and TX, meaning they have to be reassembled or monitored 
with two NICs.  Their product may have evolved since we purchased ours.  I 
deployed four of these for different data streams and piped them to a 
managed switch with a SPAN/monitor port for aggregation.  This works fine 
for us for passive monitoring.  Our network segments are all pretty low 
traffic.   Cost for a 100mb copper TAP I believe was around $800 each.

Datacom Systems:
http://www.datacomsystems.com/
Not as familiar with these, but Google popped them up.

and

Critical Taps
http://www.criticaltap.com
Reputable brand, have multiple tap rack appliances but prices are premium.

I believe at least one of these companies permit multiple monitor ports on a 
single stream of data.  I think they call them 'Regeneration Taps".

CM

_________________________________________________________________
On the road to retirement? Check out MSN Life Events for advice on how to 
get there! http://lifeevents.msn.com/category.aspx?cid=Retirement