Watching for Patterns with a Network-Based IDS

Watching for Patterns with a Network-Based IDS

[View full size image]

For a network-based IDS to work correctly, the LAN switch must be configured so that traffic to and from the firewall is copied and sent to the IDS. That way, the IDS can review the packets, searching for trends that might look like a cracker trying a cracker trick. It's like the difference between a security guard who just passed the phone repair truck through, versus one who passes the truck through but then sends someone to check up on the repairman and follow him around the building.