Snort IDS/IPS [Resolved]

Learn about Computer Security Other Security Products
#1

Greetings all!

I have some questions regarding Snort.

  1. Is it needed if you use CFP3?

  2. Does it only log suspicious traffic, or will it block it too?

  3. Is there any tutorial on how to use Snort with IDScenter? Using it without GUI would be far to complicated for me…

  4. Do you have any experiences with Snort?

  5. Any other free IDS/IPS for Windows XP?

Cheers,
Ragwing

#2

I myself have never managed to get Snort to work on my machine. You could always use a program like airsnare to monitor what’s going on with your network though CPF3 does include some IDS technologies by the ability to protect ARP Cache, Protection against UDP Etc Floods and Protocol Analysis…

IMAO not needed if using CPF3.

Eric

#3

Yep. I my previous firewall was Kerio, which used Snort and IDS. And yes, it should also block those things.

I agree with Eric and Egemen before stating that IDS relies on signatures like a blacklist, whereas CFP’s Attack Detection Settings are indiscriminate on the traffic, but based on the probe rates, etc. Although I did recall somewhere in this forum that later on CFP may include something similar to IDS (I’ll have to search for it).

Here we go: https://forums.comodo.com/leak_testingattacksvulnerability_research/what_about_inboud-t11567.0.html;msg82278#msg82278

https://forums.comodo.com/leak_testingattacksvulnerability_research/comodos_inbound_protection_is_only_basicfor_melih_and_egemen_also-t18296.0.html;msg124831#msg124831

#4

Thanks for the answers guys!
It seems like it’s not needed for home users, and especially not when you’re using CFP3! Also, the packet scanning will most likely reduce the connection speed (unlike CFP3), so I’m fine with CFP3.
I’ll close this topic now, and shall I need it opened again, I guess I’ll PM myself with a link to this topic, and a request to re-open it (:WIN)

Cheers,
Ragwing