IDS Helps

Dear All

I have another important question.

Now I have my IDS connected to my lan.. my network is like this ...

I have 20 sites(Networks) 9 of them are connected using a Fiber cable (same subnet) and the other are connected to me using one router.
Can IDS in my location (site1) detects the Intrusions in other sites which connected to me by a router??
i can ping any Ips in thos sites.
Who is Participating?
An IDS needs to be able to see all of the traffic that could be of interest.  Options are:

1. put it on a hub or spanned/mirrored port so that it sees all of the traffic in (or passing through) the subnet, or

2. put it in as a gateway so that all traffic between A and B (say, between Internet and LAN) passes through it.

It doesn't sound like your plan matches either alternative, so it probably will not achieve what you had hoped for.

IDS has to be in the same Ethernet collision domain as the network you want to monitor. A common way to do this is to use port mirroring on a switch, or to put a hub in the traffic path. You can't do what you're asking.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.