Solved

Network Based Intrustion Detection System

Posted on 2006-07-04
4
330 Views
Last Modified: 2013-11-16
I am looking for a NIDS, my budget is as of yet undefined, but I have only heard of Cisco IDS, Stealthwatch, and Snort. What else is there to look at, appliance or software based is fine, but it must have the ability to inject response packets.

Basically, I need a list of whats out there.
0
Comment
Question by:Derekleu
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
4 Comments
 
LVL 79

Accepted Solution

by:
lrmoore earned 50 total points
ID: 17037550
We have used and really like the Lockdown systems:
http://www.lockdownnetworks.com/

As well as Forescout:
http://www.forescout.com/index.php?url=products§ion=activescout

Good article on evaluating NIDS
http://www.sans.org/resources/idfaq/eval_ids.php?portal=250bde9daa8e00cb707b97b4cba5751c

Lancope Stealthwatch uses NetFLow with is an emerging technique that does not rely on known signatures
http://www.lancope.com/products/stealthwatch-demo/

You might also want to take a look at Cisco's CSMARS appliance products:
http://www.cisco.com/en/US/products/ps6241/index.html
0
 
LVL 32

Assisted Solution

by:rsivanandan
rsivanandan earned 20 total points
ID: 17037969
Some more will be ISS (Internet Security Systems) & Juniper IDP.

Cheers,
Rajesh
0
 
LVL 79

Assisted Solution

by:lrmoore
lrmoore earned 50 total points
ID: 17038064
0
 
LVL 38

Assisted Solution

by:Rich Rumble
Rich Rumble earned 30 total points
ID: 17038172
The folks who make the free IDS Snort, also make a wonderful hardware appliance and will train you on how to deploy/administer/maintain it.
http://www.sourcefire.com/products/dc.html
http://www.sourcefire.com/products/is.html
http://www.sourcefire.com/products/rna.html

There is also the 3rd party addon to Snort, SnortSAM, that will update your firewall's or router ACL's based on alerts/triggers you assign in Snort. http://www.snortsam.net/
While it's not exactly "..it must have the ability to inject response packets" it does drop/block traffic very quickly, and you can define for how long the block last's.
-rich
0

Featured Post

2017 Webroot Threat Report

MSPs: Get the facts you need to protect your clients.
The 2017 Webroot Threat Report provides a uniquely insightful global view into the analysis and discoveries made by the Webroot® Threat Intelligence Platform to provide insights on key trends and risks as seen by our users.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This process allows computer passwords to be managed and secured without using LAPS. This is an improvement on an existing process, enhanced to store password encrypted, instead of clear-text files within SQL
With the rising number of cyber attacks in recent years, keeping your personal data safe has become more important than ever. The tips outlined in this article will help you keep your identitfy safe.
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
Email security requires an ever evolving service that stays up to date with counter-evolving threats. The Email Laundry perform Research and Development to ensure their email security service evolves faster than cyber criminals. We apply our Threat…
Suggested Courses

623 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question