Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

Network Based Intrustion Detection System

Posted on 2006-07-04
4
Medium Priority
?
331 Views
Last Modified: 2013-11-16
I am looking for a NIDS, my budget is as of yet undefined, but I have only heard of Cisco IDS, Stealthwatch, and Snort. What else is there to look at, appliance or software based is fine, but it must have the ability to inject response packets.

Basically, I need a list of whats out there.
0
Comment
Question by:Derekleu
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
4 Comments
 
LVL 79

Accepted Solution

by:
lrmoore earned 200 total points
ID: 17037550
We have used and really like the Lockdown systems:
http://www.lockdownnetworks.com/

As well as Forescout:
http://www.forescout.com/index.php?url=products§ion=activescout

Good article on evaluating NIDS
http://www.sans.org/resources/idfaq/eval_ids.php?portal=250bde9daa8e00cb707b97b4cba5751c

Lancope Stealthwatch uses NetFLow with is an emerging technique that does not rely on known signatures
http://www.lancope.com/products/stealthwatch-demo/

You might also want to take a look at Cisco's CSMARS appliance products:
http://www.cisco.com/en/US/products/ps6241/index.html
0
 
LVL 32

Assisted Solution

by:rsivanandan
rsivanandan earned 80 total points
ID: 17037969
Some more will be ISS (Internet Security Systems) & Juniper IDP.

Cheers,
Rajesh
0
 
LVL 79

Assisted Solution

by:lrmoore
lrmoore earned 200 total points
ID: 17038064
0
 
LVL 38

Assisted Solution

by:Rich Rumble
Rich Rumble earned 120 total points
ID: 17038172
The folks who make the free IDS Snort, also make a wonderful hardware appliance and will train you on how to deploy/administer/maintain it.
http://www.sourcefire.com/products/dc.html
http://www.sourcefire.com/products/is.html
http://www.sourcefire.com/products/rna.html

There is also the 3rd party addon to Snort, SnortSAM, that will update your firewall's or router ACL's based on alerts/triggers you assign in Snort. http://www.snortsam.net/
While it's not exactly "..it must have the ability to inject response packets" it does drop/block traffic very quickly, and you can define for how long the block last's.
-rich
0

Featured Post

Put Machine Learning to Work--Protect Your Clients

Machine learning means Smarter Cybersecurity™ Solutions.
As technology continues to advance, managing and analyzing massive data sets just can’t be accomplished by humans alone. It requires huge amounts of memory and storage, as well as high-speed processing of the cloud.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

How does someone stay on the right and legal side of the hacking world?
Will you be ready when the clock on GDPR compliance runs out? Is GDPR even something you need to worry about? Find out more about the upcoming regulation changes and download our comprehensive GDPR checklist today !
The Email Laundry PDF encryption service allows companies to send confidential encrypted  emails to anybody. The PDF document can also contain attachments that are embedded in the encrypted PDF. The password is randomly generated by The Email Laundr…
We’ve all felt that sense of false security before—locking down external access to a database or component and feeling like we’ve done all we need to do to secure company data. But that feeling is fleeting. Attacks these days can happen in many w…

721 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question