Solved

Network Based Intrustion Detection System

Posted on 2006-07-04
4
329 Views
Last Modified: 2013-11-16
I am looking for a NIDS, my budget is as of yet undefined, but I have only heard of Cisco IDS, Stealthwatch, and Snort. What else is there to look at, appliance or software based is fine, but it must have the ability to inject response packets.

Basically, I need a list of whats out there.
0
Comment
Question by:Derekleu
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
4 Comments
 
LVL 79

Accepted Solution

by:
lrmoore earned 50 total points
ID: 17037550
We have used and really like the Lockdown systems:
http://www.lockdownnetworks.com/

As well as Forescout:
http://www.forescout.com/index.php?url=products§ion=activescout

Good article on evaluating NIDS
http://www.sans.org/resources/idfaq/eval_ids.php?portal=250bde9daa8e00cb707b97b4cba5751c

Lancope Stealthwatch uses NetFLow with is an emerging technique that does not rely on known signatures
http://www.lancope.com/products/stealthwatch-demo/

You might also want to take a look at Cisco's CSMARS appliance products:
http://www.cisco.com/en/US/products/ps6241/index.html
0
 
LVL 32

Assisted Solution

by:rsivanandan
rsivanandan earned 20 total points
ID: 17037969
Some more will be ISS (Internet Security Systems) & Juniper IDP.

Cheers,
Rajesh
0
 
LVL 79

Assisted Solution

by:lrmoore
lrmoore earned 50 total points
ID: 17038064
0
 
LVL 38

Assisted Solution

by:Rich Rumble
Rich Rumble earned 30 total points
ID: 17038172
The folks who make the free IDS Snort, also make a wonderful hardware appliance and will train you on how to deploy/administer/maintain it.
http://www.sourcefire.com/products/dc.html
http://www.sourcefire.com/products/is.html
http://www.sourcefire.com/products/rna.html

There is also the 3rd party addon to Snort, SnortSAM, that will update your firewall's or router ACL's based on alerts/triggers you assign in Snort. http://www.snortsam.net/
While it's not exactly "..it must have the ability to inject response packets" it does drop/block traffic very quickly, and you can define for how long the block last's.
-rich
0

Featured Post

How to Defend Against the WCry Ransomware Attack

On May 12, 2017, an extremely virulent ransomware variant named WCry 2.0 began to infect organizations. Within several hours, over 75,000 victims were reported in 90+ countries. Learn more from our research team about this threat & how to protect your organization!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Keystroke loggers have been around for a very long time. While the threat is old, some of the remedies are new!
Many of you may be aware of the recent Google Docs scam emails that have been floating around coming from various people that you know. Here's a guide on identifying How To Identify the Scam Email You will see an email from someone you’ve had co…
Email security requires an ever evolving service that stays up to date with counter-evolving threats. The Email Laundry perform Research and Development to ensure their email security service evolves faster than cyber criminals. We apply our Threat…
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …

751 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question