<html><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, Sans-Serif;font-size:12pt"><div><span>Andreas I like your last paragraph by the way, by the way SNORT it fine its only need time and skill to configure it. Get yourself a descent high spec server will server the purpose instead of spending $$$ on purchasing a UTM box. </span></div><div></div><div> </div><div><font color="#a2a2a2"><font color="#737373">------------------------------<br>Adili David Marandu, <br></font></font><font color="#a2a2a2"><font color="#737373">, </font></font><font color="#a2a2a2"><br><br></font><br></div><div><br></div> <div style="font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 12pt;"> <div style="font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 12pt;"> <div
dir="ltr"> <hr size="1"> <font size="2" face="Arial"> <b><span style="font-weight:bold;">From:</span></b> Andreas Tauscher <ta@geuka.net><br> <b><span style="font-weight: bold;">To:</span></b> loserian saiterie <lwsaiterie@yahoo.com>; Linux Users in Arusha <linux@lists.habari.co.tz> <br> <b><span style="font-weight: bold;">Sent:</span></b> Thursday, 20 February 2014, 16:03<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: [ALUG] Intrusion Prevention and Detection System (IPDS)<br> </font> </div> <div class="y_msg_container"><br><br clear="none">> Any one who knows the supplier of IPDS (software or hardware) for network in arusha?<br clear="none"><br clear="none">Experience with hardware/appliances: Most are crap. Promising things<br clear="none">they can not fulfil.<br clear="none"><br clear="none">First questions what kind of intrusion has to be detected or more exact:<br clear="none">What do you want to protect and
why does it need protection?<br clear="none"><br clear="none">If it is for example a web service you need, can not replace but the<br clear="none">supplier does not fix some bugs. A proxy like privoxy can help you<br clear="none">filtering.<br clear="none"><br clear="none">And the best IDS is useless if it is not permanent updated or nobody is<br clear="none">reading and understanding the reports or receiving alerts.<br clear="none">Happened all: Spending thousands of dollars on snake oil hardware and it<br clear="none">stopped working years ago (and nobody recognized) because nobody was<br clear="none">clearing the alerts: Storage full. And why: The addresses and phone<br clear="none">numbers for alerts have been wrong.<br clear="none"><br clear="none">The mentioned SNORT is fine. Working really good, but if nobody<br clear="none">understands how it is working and for what you are really looking it<br clear="none">ends up usually with a lot (all
available) of rules enabled, causing<br clear="none">thousands of false alarms every day so nobody is giving attention to it<br clear="none">any more.<br clear="none"><br clear="none">You must know exact for what you are looking.<br clear="none">A IDS is not a glass ball.<br clear="none">If you hope you buy it, switch it on and it will protect you: Better<br clear="none">place a cup of holy water beside the router. It will do the same job and<br clear="none">the saved money you invest then better in Nyama choma and beer.<br clear="none">And the prevention: It can only prevent what it knows about. But then is<br clear="none">my question always: Why is this not fixed in the protected software?<br clear="none"><br clear="none">Andreas<div class="yqt3074254673" id="yqtfd03846"><br clear="none">_______________________________________________<br clear="none">The Arusha Linux User Group: <a shape="rect" href="http://unix.or.tz/"
target="_blank">http://unix.or.tz</a><br clear="none">Linux mailing list<br clear="none"><a shape="rect" ymailto="mailto:Linux@lists.habari.co.tz" href="mailto:Linux@lists.habari.co.tz">Linux@lists.habari.co.tz</a><br clear="none"><a shape="rect" href="http://lists.habari.co.tz/cgi-bin/mailman/listinfo/linux" target="_blank">http://lists.habari.co.tz/cgi-bin/mailman/listinfo/linux</a><br clear="none"><br clear="none">The Arusha LUG mailing list is generously hosted by Habari Node Ltd: <a shape="rect" href="http://www.habari.co.tz/" target="_blank">http://www.habari.co.tz/</a><br clear="none"><br clear="none">The above comments and data are owned by whoever posted them (including attachments if any). The mailing list host is not responsible for them in any way.<br clear="none"></div><br><br></div> </div> </div> </div></body></html>