Re: How to choose an IDS/FW MSS provider

On Sat, 12 Mar 2005 11:41:46 -0800 (PST), Peter Schawacker
<peter@schawacker.com> wrote:
> Hi Kevin,
>
> You make some good points, but I wanted to clarify
> something that you wrote.  McAfee's IntruShield NIPS
> appliance does not run Linux.

I was basing my statements on 'nmap' results, on job postings
from Intrusec/NAI for Linux kernel/driver programmers for the
Intrushield team (Google archive of past openings), and also
the GPL/LGPL violation complaints against NAI/Intrusec
from about this time last year (kernel, grub, zebra).


> Also, it is ASIC/FPGA-based.  Each IntruShield appliance does
> include a celeron processor, but that Intel chip is
> used only for management.

Specifically it *appears* that the management processor
runs VxWorks, which is decidely "not linux".  Can't really
confirm this guess at 3AM.


> All of the IDS/IPS work is done using FPGA's, ASIC's and network processors.
>
> BTW, I work for McAfee.
>
> Peter

Good to see honest open responses including the
disclaimer of employment.  On that topic, I have
never worked for any vendor of security solutions,
though I have often been employed by their customers.


Kevin

--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from 
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
--------------------------------------------------------------------------