Re: IDS and Bandwidth

On Tuesday, 2005-07-05 at 03:46 GMT, bhaskar.gupta@tcs.com wrote:
> I am working as an IDS operator in my company. Due to big size of the 
> organisation, different IDS nodes are monitoring different centers 
through a 
> central master node. Since there are lot of incidents ( including false 
> positives ) generated across the organsation, there is a complaint from 
our 
> networking team that IDS is consuming lot of bandwidth over networking
>
> I am really not able to figure out how much IDS can eat up network 
bandwidth.

If you were mirroring all traffic to a central IDS for analysis, that 
could easily consume all available bandwidth.

If you are only forwarding detected positives to the central site, that 
should normally be less than 1% of the monitored traffic on individual 
remote links.  Only if you had extremely many remote links or relatively 
low bandwidth into your central site should this result in a significant 
load on the central links.

Tony Rall

--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from 
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
--------------------------------------------------------------------------