Darren also asked:
> > And what then will the IDS system be able to do ?
[Sorry, I missed this sentence in my first reading]
We'd also hope that the IDS would alert on the intrusion due to the
attempted co-opting of the switch, since it's a part of our
infrastructure we would want it monitored, and if that were successful, we
would also hope that it would also alarm on the loss of multi-MAC traffic on
the link. 'Alarm on what we know is bad' isn't as encompassing as 'Alarm
because we haven't seen anything good', and I'd expect to be able to have
a mix of the two.
Paul
-----------------------------------------------------------------------------
Paul D. Robertson "My statements in this message are personal opinions
proberts @
clark .
net which may have no basis whatsoever in fact."
PSB#9280
References:
|
|
