IDSM-2 vs Snort

[alain.bider]

Hi,

I have a customer which has 6 cat6500 in the core and is looking for an ids solution.

Beside the idsm-2 he wants to evaluate snort. As i have no experience on that product i'm advised on your help/input:

-Pros/cons

-where to deploy ids sensors

-is snort interoperable with CW??

Thansk for your feedback

Alan

[rburkholder]

Perhaps info can be found in the book represented by:

http://booksmatter.com/b0072229543.htm

Or perhaps the presentation at

http://www.ciscoexpo.gr/2003/download/19/b2/CISCO_MARCO_MISITANO.pdf

might be helpful.

As for first hand knowledge, I can't help. I have some snort experience, so if someone has idsm experience perhaps we can compare notes.

[alain.bider]

Thanks, the presentation helps about where positionning sensors, but that's about it...

I'm more interested in pros&cons of deplyoing idsm2 vs snort, can snort sniff trunks or is it limited to 1 vlan, performance comparison,...

Also i'm looking for some information on SIMS. If deployed what kind of info can be correlated from snort....

regards,

Alan

[dewman03]

I got the chance to use a snort based appliacne by "sourcefire" and was pretty impresed by it. I have a few cisco ids appliances currently, and while i liked the familiar interface of the cisco, the snort based device was very verbose. The sourcefire appliance is also able to sniff trunks and report on all our vlans like the cisco. It gave links to definitions of the signatures and had quite a few selectable signatures.You can sort be severity of signature and generate reports with graphs. Sourcefire also makes an "RNA sensor" which is really cool.

[jboyer]

Snort is a great product but since this customer already has cat6500 switches, the idsm2 is going to be the best performance, and most flexible. The biggest advantage it will have over snort is the active response mechanisms. Combined with VMS and optionally Threat Response they can shun via pix firewalls or dynamically modify ACLs on Cisco routers to thwart attacks. They may want to mix in IDS42xx sensors at edges of their network, they can all be managed together via VMS and TR.

Snorts one and only advantage will be less $$$.

[a.arndt]

I agree with Jeff Boyer that the IDSM-2 is the better solution, as it is ultimately more flexible.

IMHO, the bigger deal here is the fact that an IDSM-2 works in a totally different manner than