New answers tagged ids
Based on the description of fwsnort it is a packet level IDS using the iptables string matching feature. This means that it can not apply any rules which span multiple packets. This includes any serious application level analysis like looking into SMTP (mail) and HTTP (web) traffic. Thus if you care mostly about attacks at the lower layers it might be ...
DNS request logging on your local DNS forwarder (Domain Controllers) is the easiest. Blocking TCP/UDP port 53 outbound except for your Domain Controllers lets you be assured that only they can do recursive DNS lookups. Netflow is another option, but has large data storage requirements since you are storing lifecycle and endpoint information about all UDP ...
In IDS in the classical sense is passive (D for detection) and can not drop a packet. In IPS instead (P for prevention) can drop the packet and better should do it. But the usage of the words IDS, IPS, firewall etc is too vague today that it is not clear which kind of technique you are talking about.
Top 50 recent answers are included