need advice (xp pro 2 Redhat networking)

[Danhole 0]

i thought hats were out of style.

[nathaniel 0]

I used to run snort on my linux boxes (debian, thank you) when I was in college. Its usefulness as an IDS depends on what you mean by IDS. Snort was very good for telling me the number of times I got portscanned / spammed with the IIS crack of the month, but didn't offer much in the way of network monitoring--ie, what's happening over there, not over here. For that you really need a bastion host(s) on your network.

On the whole I'm rather skeptical of IDS's...I lump them together with AV software as intrinsically reactive. Running snort won't help you if you don't keep your fingerprints up to date...and some worms propagate faster than they get fingerprinted. There was a very good blackpaper about this circulated on Bugtraq a while ago...the researchers postulated that a well written worm could saturate the internet in as little as a couple minutes.

And worse yet, there is the issue of the Halting Problem. For all you non-CS types, basically the only way to be absolutely sure what any piece of code (eg, is it a virus or screensaver?) does is to run it...and if it's a virus it's too late

So the deck is stacked against IDS's imnsho.

Don't get me wrong, IDS's and AV are very helpful in some circumstances (eg, dealing with hordes of clueless lusers), but I don't like them.

Nathaniel

My advice is to do what your parents did; get a job, sir. The bums will always lose. Do you hear me, Lebowski?

[skybytch 259]

Dammit! Knock it off! Don't you guys know what all this geek talk does to me???

I knew I should have saved this thread until I got home.