Intrusion
Detection Systems (IDS)
Group Test�(Edition
2)
Foreword
Welcome to the Second
Edition of the Intrusion Detection System (IDS) Group Test report
This report started
life in 2000 as part of the IDS/VA testing project. Given the increase in
the number of participants this year, however, we have decided to divide
the report into two: one covering Vulnerability Assessment, and the other
Intrusion Detection Systems.
Unfortunately, not
every vendor who took part in Edition 1 was able to resubmit products this
year against our latest testing methodology. This is not because of any
lack of desire to participate, however, but rather that they were awaiting
a significant new release before resubmitting their products for testing.
Next year, when our current methodology will undergo a complete overhaul,
we would hope to be able to re-test all of the products in the current and
previous editions.
In this report we have
sixteen IDS products, two of which are updated and six of which are new
entries, including our first look at the most popular open source IDS �
Snort. We have also updated the introductory and summary material, which
we would encourage you to read since it covers many of the concepts
mentioned in the technical evaluations.
Demand for, and
interest in, this report has been tremendous. Feedback confirms we are
providing a major source of much needed information and advice to security
professionals, and The NSS Group IDS Report is considered the
definitive guide to IDS. Edition 2 provides independent and comprehensive
technical evaluations of the current leading products in the market place,
and we hope you find it informative and useful.
Bob
Walder
Table of Contents
Introduction
Host
IDS (HIDS)
Network IDS (NIDS)
Network Node IDS
(NNIDS)
Problems
with IDS
Detection Methods
The Circle of Strife
Product Reviews
Cisco
Secure IDS V2.5
Architecture
Installation
Configuration
Reporting
and Analysis - netForensics
Verdict
Contact Details
CA
eTrust Intrusion Detection V1.4.5
Architecture
eTrust
Intrusion Detection Enterprise
Installation
Configuration
Reporting and
Analysis
Verdict
Contact Details
CyberSafe
Centrax 2.4
Architecture
Installation
Configuration
Policy
Definition
Vulnerability
Assessment
Policy
Application
Scheduler
Reporting
and Analysis
Verdict
Contact
Details
Enterasys Dragon
Sensor 4.2
Architecture
Installation
Configuration
Reporting and
Analysis
Verdict
Contact Details
Entercept 2.01
Architecture
How Does It Work?
Installation
Configuration
Reporting and
Analysis
Verdict
Contact Details
Intrusion Inc.
SecureNet Pro 4.0
Architecture
SecureNet Pro
Sensor
SecureNet Pro
Console
Communication
Architecture
Sensing
Architecture
Installation
Configuration
Reporting and
Analysis
Verdict
Contact Details
ISS Real Secure
5.0
Architecture
Installation
Configuration
Reporting and
Analysis
Verdict
Contact Details
LanGuard S.E.L.M
Architecture
Installation
Configuration
Reporting and
Analysis
Verdict
Contact Details
Network Ice
BlackIce Sentry
Architecture
Pattern Matching
v Protocol Analysis
Installation
Centralised
Deployment via InstallPac
Configuration
BlackICE GUI
Firewall
Logging
Management via
ICEcap
Reporting and
Analysis
Verdict
Contact Details
NFR NID-200 V1.1
Architecture
Administration
Interface (AI)
Central
Management Server (CMS)
NID Sensor
Sensor Engine
Backends
Packages
Installation
Configuration
Reporting and
Analysis
Verdict
Contact Details
nSecure nPatrol
IDS V1.3.2
Architecture
nPatrol Engine
nPatrol Internal
Agent
nPatrol External
Agent
nPatrol Anomaly
Agent
Installation
Configuration
Reporting and
Analysis
Verdict
Contact Details
Snort 1.8.1
Architecture
Packet Decoder
Detection Engine
Logging &
Alerting Subsystem
Installation
Configuration
Reporting and
Analysis
Verdict
Contact Details
Symantec Intruder
Alert 3.5
Architecture
Installation
Configuration
Reporting and
Analysis
Event Viewer
Report Generator
Verdict
Contact Details
Symantec
NetProwler 3.5.1
Architecture
Installation
Configuration
Reporting and
Analysis
Verdict
Contact Details
Tripwire for
Servers V2.4.2
Architecture
Tripwire for
Servers
Tripwire Manager
Installation
Configuration
Reporting and
Analysis
Verdict
Contact Details
Performance
Testing
How We Tested
Test Results
Summary - Performance Testing
Summary
Appendix A -
Vendor Questionnaires
Appendix B - The
Test Equipment
Appendix C - The
Test Network

|