Intrusion Detection System

Intrusion Detection System
NewsGroups | Search | Tools
User Password
Register Now! Lost Password?
 comp.dcom.sys.cisco  Post an article  get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content  add this group's latest topics to your Google content  YahooMyWeb Yahoo!  Google Google  Windows Live Favorites Windows Live  del.icio.us del.icio.us  digg digg  Add to Netscape Netscape
Subject Author Date
Intrusion Detection System Anthony Fischer 01-13-2006
Posted by Anthony Fischer on January 13, 2006, 12:26 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
My company has recently purchased a Cisco 2801 router with IDS support.
We're starting to test IDS and are noticing that when it is enabled, even
with only 1 signature turned on, web browsing is significantly slowed down.
Can anyone shed some light on this subject or provide any suggestions,
besides disabling IDS, to solve the problem? When we turn IDS off
completely, web traffic flows at a much higher rate.

I'm happy to explain any details further if necessary. Thank you.

--
Tony



home networking made easy, greater protection, less stress, introducing nm 5.0, 728x90
Posted by Wil on January 13, 2006, 1:51 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
I had the same issue, webex was pretty much useless while others were
frustratingly slow. All layer 3-4 testing showed no issues though. I had
a TAC case open because of it crashing the router for various reasons as
well. I just disabled IPS and told TAC to close the case after 2 months :)

IPS is NOT ready for production yet, IMHO.

Wil
my 3¢

Posted by Anthony Fischer on January 13, 2006, 2:12 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Wil -

Thank you greatly for your response. When I was doing initial testing, with
one PC behind the router, all traffic but web browsing worked just like
expected. But as soon as I would try to browse the web or download someting
from a web page, average speed was about 9K/sec if I recall correctly. It
was like port 80 was the only traffic that was being effected and all I did
was turn IPS on and didn't even touch the signatures. I was using the
128MB.sdf file at the time. Most other reports I'm seeing on the web seem to
end with disablin IPS alltogether as well unfortunately.

I'm curious... How was your experience with TAC on this particular issue?
Were they willing to help or were they resistant because it's so new? Did it
seem like they were just fumbeling around in the dark? Did the tech happen
to express any of his/her views on the state of IPS? I only ask because
we'll most likely be opening up a ticket soon.

Thanks again.

--
Tony


>I had the same issue, webex was pretty much useless while others were
>frustratingly slow. All layer 3-4 testing showed no issues though. I had a
>TAC case open because of it crashing the router for various reasons as
>well. I just disabled IPS and told TAC to close the case after 2 months :)
>
> IPS is NOT ready for production yet, IMHO.
>
> Wil
> my 3¢



Posted by Wil on January 13, 2006, 2:24 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
I was using the 256.sdf file, 3845 router. The reason that I originally
opened a TAC case was because I caught the bugger crashing in my logs, I
just so happened to be on the console while it dumped.

Once I opend the case they asked me to send them the 256.dsf file, they
couldn't locate it because it was so new. No problem, they found the
problem signiture and had me disable it, then later delete it. I left
the case open planning to update the 256.sdf file, or image, or whatever
the recommended fix was and viola, started to get crashes again two
weeks later. Deleted another recommended signiture.

Users were complaining about slowness that I had wrongly attributed to
distance (since I couldn't see any problems at L2-4), so one day I
figured that I would strip the config to see if things got better for
them, and it did! Reapplied features one at a time and found that it was
the IPS that was slowing everything down. I asked TAC about it and they
told me it was a different issue, open another case, etc. Instead I just
closed the current one and turned off IPS, logs are a little lighter but
my users aren't complaining. Still running with ACL's and CBAC, no problems.

Wil
my 3¢

Posted by Anthony Fischer on January 13, 2006, 6:03 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Fantastic. Thanks for your replies Wil. Have a great weekend!

--
Tony


>I was using the 256.sdf file, 3845 router. The reason that I originally
>opened a TAC case was because I caught the bugger crashing in my logs, I
>just so happened to be on the console while it dumped.
>
> Once I opend the case they asked me to send them the 256.dsf file, they
> couldn't locate it because it was so new. No problem, they found the
> problem signiture and had me disable it, then later delete it. I left the
> case open planning to update the 256.sdf file, or image, or whatever the
> recommended fix was and viola, started to get crashes again two weeks
> later. Deleted another recommended signiture.
>
> Users were complaining about slowness that I had wrongly attributed to
> distance (since I couldn't see any problems at L2-4), so one day I figured
> that I would strip the config to see if things got better for them, and it
> did! Reapplied features one at a time and found that it was the IPS that
> was slowing everything down. I asked TAC about it and they told me it was
> a different issue, open another case, etc. Instead I just closed the
> current one and turned off IPS, logs are a little lighter but my users
> aren't complaining. Still running with ACL's and CBAC, no problems.
>
> Wil
> my 3¢



Similar ThreadsPosted
Intrusion *Prevention* on Cisco (IPS) December 28, 2004, 9:55 pm
Solutions Fast Track - Monitoring and Intrusion July 20, 2008, 11:14 pm
Anomaly detection May 2, 2007, 11:47 am
Jam signal and collision detection April 20, 2005, 8:40 am
ASA 7.2 - Dead Connection Detection (DCD) September 25, 2006, 2:58 pm
good cisco and juniper IPS site for intrusion prevention and cisco switch info January 5, 2007, 4:59 pm
Autonomous System in BGP April 19, 2005, 2:51 am
Basic IPCC Lab System May 10, 2006, 11:32 am
fwsm backup system November 1, 2006, 5:14 am
boot system command April 11, 2007, 6:05 am

other useful resources:
The Federal Communications Commission (FCC)
Telecommunications Industry Association
Electronic and Software Security Products and Services
International Telecommunication Union

Custom CGI Perl and PHP programming by 1-Script.com

Contact Us | Privacy Policy
The site map in XML format XML site map