RE: [Security400] Snort Rules

["Fritz Hayes" <fhayes@xxxxxxxxxxxxx>]

Please, don't worry about the "dumb" questions.  In this arena, it is
sooo easy to get lost.  But it is nice to be over some tall guys head as
I am not tall!

The way that a good Intrusion Detection System (IDS) works is it sits on
the wire and just watches the packets fly by.  All IDS boxes are packet
sniffers.  IDS just watches and analyzes the packet streams, looking for
the tell-tale Intrusion signitures.  They are not like a firewall or
packet shaper box where all the traffic passes through the equipment.

But in this day of switches, the location of the IDS box is critical to
seeing what is happening with any one server or network access point.
With a switched system, the way to monitor the AS/400 is to plug the 400
into a 100 MB hub (3 ports minimum) and then plug the hub into the
switch.  The IDS then get plugged into the 100MB hub.  This way, the IDS
sees all the traffic that the AS/400 sees (but may not report).

Best Regards

Fritz Hayes
Atwater Associates

|
|You are way over my head, which other than the fact I am tall,
|isn't a real surprise :-)
|
|
|Are you saying the actual incoming ethernet from the router
|passes through this PC and then onto the iSeries ?
|
|Thanks and sorry if this is a dumb question...
|
|Chuck
|
|_______________________________________________
|This is the Security Administration on the AS400 / iSeries
|(Security400) mailing list To post a message email:
|Security400@midrange.com To subscribe, unsubscribe, or change
|list options,
|visit: http://lists.midrange.com/cgi-bin/listinfo/security400
|or email: Security400-request@midrange.com
|Before posting, please take a moment to review the archives
|at http://archive.midrange.com/security400.
|