Re: [Security400] Snort Rules

[Larry Bolhuis <lbolhuis@xxxxxxxxxx>]

Just a coupla things about where to place the IDS.

1) Using the little 'hublet' has the disadvantage of taking away full duplex
operation from the iSeries to switch link. May not be a problem in your
environment depending on traffic volumn.

2) Most switches have some sort of monitoring option such as SPAN. You
select one of the ports as the monitor port and connect the IDS there. You
then further select which ports you want to see all the traffic for and the
switch 'BCCs' the SPAN port on all packets for the designated ports. Usually
you can't select them all or the SPAN port becomes a bottleneck. Advantage
is that all the ports can stay full duplex (even the IDS port) and you can
select what to monitor without changing any wires! (Also frees up the hublet
to cause problems somewhere else in the network :-) )

  HTH - L

Fritz Hayes wrote:

> But in this day of switches, the location of the IDS box is critical to
> seeing what is happening with any one server or network access point.
> With a switched system, the way to monitor the AS/400 is to plug the 400
> into a 100 MB hub (3 ports minimum) and then plug the hub into the
> switch.  The IDS then get plugged into the 100MB hub.  This way, the IDS
> sees all the traffic that the AS/400 sees (but may not report).

--
Larry Bolhuis           | IBM Certified Solutions Expert
Vice President          |     iSeries Technology V5 R1
Arbor Solutions, Inc.   |     e-business for AS/400 V4 R2
(616) 451-2500          | IBM Certified Specialist  AS/400
(616) 451-2571 -fax     |     RPG IV Developer
lbolhuis@arbsol.com     |     System Administrator for OS/400 V4 R4
www.arbsol.com          |     Professional Network Administrator
                         |       Network/Multiple Systems
                         |     Client Access