Hardly!, my understanding was that you had to run multiple IDS blades to even approach the backplane capacity. Do you realize the Cisco IDS blade has a maximum of 100Mbps traffic it can monitor? It uses SPAN and or VLAN monitoring, and last I saw you couldn't put 30 blades in a 6500 chassis! Was NETRANGER ever a best of breed product?
Read this: http://www.cisco.com/warp/public/cc/pd/si/casi/ca6000/prodlit/6kids_ds.h tm As far as RealSecure bandwidth problems, I never encountered these. (provided the sensor was a beefy box) For raw packet decode, tying an NAI DSS Sniffer to RS events works nicely! I would rather use the sniffer interface anyway. Has anyone tested IDS solutions at gigabit speeds and have any realworld experience to report? > -----Original Message----- > From: Mailing list for discussion of Firewall-1 > [mailto:[EMAIL PROTECTED]] On > Behalf Of Charles Piombi > Sent: Friday, November 30, 2001 9:56 AM > To: [EMAIL PROTECTED] > Subject: Re: [FW-1] Best IDS?? > > > The best IDS would be Cisco's IDS blades for there 6500 series switch > they are non-intrusive and can handle 30 Gig's on the back plane much > higher than any other IDS system and you can set it up via vlans for > internal and external traffic. > > That's my two cents! > > Thanks Charles Piombi > > > > -----Original Message----- > From: Mailing list for discussion of Firewall-1 > [mailto:[EMAIL PROTECTED]] On > Behalf Of Enno > Rey > Sent: Thursday, November 29, 2001 1:51 PM > To: [EMAIL PROTECTED] > Subject: Re: [FW-1] Best IDS?? > > Hi, > > don't take RealSecure. They (still) have bandwidth issues, you can't > write > your own signatures [which is rather critical for an IDS] and =============================================== To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ===============================================
