Is it possible for you to find out how much the mean traffic is coming
to the central node from the various distributed nodes?
What flavour of IDS are you using, and on what platform?
On 7/5/05, Tony Rall <trall@almaden.ibm.com> wrote:
On Tuesday, 2005-07-05 at 03:46 GMT, bhaskar.gupta@tcs.com wrote:
I am working as an IDS operator in my company. Due to big size of the
organisation, different IDS nodes are monitoring different centers
through a
central master node. Since there are lot of incidents ( including false
positives ) generated across the organsation, there is a complaint from
our
networking team that IDS is consuming lot of bandwidth over networking
I am really not able to figure out how much IDS can eat up network
bandwidth.
If you were mirroring all traffic to a central IDS for analysis, that
could easily consume all available bandwidth.
If you are only forwarding detected positives to the central site, that
should normally be less than 1% of the monitored traffic on individual
remote links. Only if you had extremely many remote links or relatively
low bandwidth into your central site should this result in a significant
load on the central links.
Tony Rall
--------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
--------------------------------------------------------------------------
--------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
--------------------------------------------------------------------------
