Re: The devil's in the details

["Paul V. Alukal" <palukal () ra hpw stf bms com>]

I had come across a similar situation about a year back at a client
site, and at that time, some switch vendors were not providing a port
to see all the traffic through the switch. In addition, the IDS
software we were using (fom a well known vendor) was only providing
network based IDS software. (We decided to use shared hubs at few key
places on the network).

In addition to using shared hubs at few key locations, I think you can
try to solve this switch problem by providing a combination of network
and host based IDS software. The vendor whom we used that time is now
providing both host based and network based IDS software components.

Paul V. Alukal
Consultant  ( http://www.securedigit.com )
Bristol-Myers Squibb Company
Princeton

On Tue, 13 Jul 1999, Matt Dunn wrote:

> Hi all, 
>
> I'm doing some preliminary planning for a security configuration, and I
> have what may be a silly question about setting up an IDS. I looked around
> a bit, and even asked a couple people (who laughed, but it didn't sound
> like it was because the question was silly, more of a 'good luck' kind of
> laugh..)
>
> My problem is that a couple of my networks involve switches, which, as part
> of the new and improved security policy, will involve VLANs.
>
> I could throw the IDS on a hub with the firewall and connect that to the
> switch, but that doesn't do anything for internal threats (which are what
> is necessitating the VLANs.)
>
> Has anyone figured out a good way to set something like this up? Ideally,
> some switch manufacturer would have thought of this ahead of time, and made
> a port on the switch that dumped all the packets, but then you're dealing
> with packet loss unless that one port is significantly faster than the rest
> of the switch. I could try to figure out some policy based configuration,
> but I don't want to go buy a gigabit plane for each of my switches, and it
> doesn't sit right with me to depend on the switch management elements for
> the completeness of my security data.
>
> Any responses would be appreciated.
>
> -Matt