North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: Using snort to detect if your users are doing interesting things?

  • From: Randy Bush
  • Date: Thu Jun 09 14:52:26 2005

>> My suggestion, in the case that you'll use snort, is to do some extensive
>> testing on a non-production network.  Take the time to learn and
>> understand its functionality and intended purpose.
> Also figure out what you're going to do with the output.  Do you have 
> the resources to investigate apparent misbehavior?  Remember that any 
> IDS will have a certain false positive rate.  Even for true positives, 
> do you have the customer care resources to notify your users and (if 
> appropriate) hold their hands while they disinfect their machines.

it's  enough of a pita to clean up the syslogs from all the 25k/day
password attacjs per host, when one does not have password ssh
even enabled.