Securing Windows NT/2000 Servers for the Internet

Network-Based Intrusion Detection Systems

Intrusion detection systems (IDSs) used to be a technology for analyzing host-based audit logs. In recent years, network -based intrusion detection systems (NIDSs) have grown in popularity. A network-based IDS analyzes traffic on a network in real time. If it sees an “attack” pattern on the network, it sends an alert to a management station.

The NIDS often has one network interface without an IP address that is passively monitoring a network. This makes it extremely difficult to attack the NIDS from the monitored network. Another network interface is used to manage the NIDS. A sample NIDS setup is shown in Figure 6.10.

Figure 6-10. An NIDS deployment example

The NIDS matches patterns on the network against its database of known attack signatures. An example of a known attack is the so-called ping of death denial of service attack. The signature of that particular attack is an ICMP echo request that’s larger than the maximum IP datagram size of 65535 bytes.

Intrusion detection systems are useful, but some customers seem to think that an NIDS is the solution to all their problems. There are, however, several problems with network-based IDSs:

To make a good decision, the NIDS cannot drop a single packet

As network speeds increase, will the NIDS be able to keep up?

The NIDS can only discover attacks in its attack-pattern database

The NIDS cannot ...