Betting Sites Not On Gamstop UK 2025Betting Sites Not On GamstopCasino Not On Gamstop

NSS Group logo

Intrusion Detection Systems (IDS)

Group Test�(Edition 2)

Foreword

Welcome to the Second Edition of the Intrusion Detection System (IDS) Group Test report

This report started life in 2000 as part of the IDS/VA testing project. Given the increase in the number of participants this year, however, we have decided to divide the report into two: one covering Vulnerability Assessment, and the other Intrusion Detection Systems.

Unfortunately, not every vendor who took part in Edition 1 was able to resubmit products this year against our latest testing methodology. This is not because of any lack of desire to participate, however, but rather that they were awaiting a significant new release before resubmitting their products for testing. Next year, when our current methodology will undergo a complete overhaul, we would hope to be able to re-test all of the products in the current and previous editions.

In this report we have sixteen IDS products, two of which are updated and six of which are new entries, including our first look at the most popular open source IDS � Snort. We have also updated the introductory and summary material, which we would encourage you to read since it covers many of the concepts mentioned in the technical evaluations.

Demand for, and interest in, this report has been tremendous. Feedback confirms we are providing a major source of much needed information and advice to security professionals, and The NSS Group IDS Report is considered the definitive guide to IDS. Edition 2 provides independent and comprehensive technical evaluations of the current leading products in the market place, and we hope you find it informative and useful.

Bob Walder

Table of Contents

Introduction
Host IDS (HIDS)
Network IDS (NIDS)
Network Node IDS (NNIDS)
Problems with IDS
Detection Methods
The Circle of Strife

Product Reviews

Cisco Secure IDS V2.5
Architecture
Installation
Configuration
Reporting and Analysis - netForensics
Verdict
Contact Details

CA eTrust Intrusion Detection V1.4.5
Architecture
eTrust Intrusion Detection Enterprise
Installation
Configuration
Reporting and Analysis
Verdict
Contact Details

CyberSafe Centrax 2.4
Architecture
Installation
Configuration
Policy Definition
Vulnerability Assessment
Policy Application
Scheduler
Reporting and Analysis
Verdict
Contact Details

Enterasys Dragon Sensor 4.2
Architecture
Installation
Configuration
Reporting and Analysis
Verdict
Contact Details

Entercept 2.01
Architecture
How Does It Work?
Installation
Configuration
Reporting and Analysis
Verdict
Contact Details

Intrusion Inc. SecureNet Pro 4.0
Architecture
SecureNet Pro Sensor
SecureNet Pro Console
Communication Architecture
Sensing Architecture
Installation
Configuration
Reporting and Analysis
Verdict
Contact Details

ISS Real Secure 5.0
Architecture
Installation
Configuration
Reporting and Analysis
Verdict
Contact Details

LanGuard S.E.L.M
Architecture
Installation
Configuration
Reporting and Analysis
Verdict
Contact Details

Network Ice BlackIce Sentry
Architecture
Pattern Matching v Protocol Analysis
Installation
Centralised Deployment via InstallPac
Configuration
BlackICE GUI
Firewall
Logging
Management via ICEcap
Reporting and Analysis
Verdict
Contact Details

NFR NID-200 V1.1
Architecture
Administration Interface (AI)
Central Management Server (CMS)
NID Sensor
Sensor Engine
Backends
Packages
Installation
Configuration
Reporting and Analysis
Verdict
Contact Details

nSecure nPatrol IDS V1.3.2
Architecture
nPatrol Engine
nPatrol Internal Agent
nPatrol External Agent
nPatrol Anomaly Agent
Installation
Configuration
Reporting and Analysis
Verdict
Contact Details

Snort 1.8.1
Architecture
Packet Decoder
Detection Engine
Logging & Alerting Subsystem
Installation
Configuration
Reporting and Analysis
Verdict
Contact Details

Symantec Intruder Alert 3.5
Architecture
Installation
Configuration
Reporting and Analysis
Event Viewer
Report Generator
Verdict
Contact Details

Symantec NetProwler 3.5.1
Architecture
Installation
Configuration
Reporting and Analysis
Verdict
Contact Details

Tripwire for Servers V2.4.2
Architecture
Tripwire for Servers
Tripwire Manager
Installation
Configuration
Reporting and Analysis
Verdict
Contact Details

Performance Testing
How We Tested
Test Results
Summary - Performance Testing

Summary

Appendix A - Vendor Questionnaires

Appendix B - The Test Equipment

Appendix C - The Test Network

Click here to download a copy of this report in PDF format

Send mail to [email protected] with
questions or comments about this web site.
Copyright � 1991-2002 The NSS Group.
All rights reserved.