How should a network be configured for an IDS server?

Question

If a linux virtual machine is deployed with snort installed, how does it detect traffic that's going to every other IP on the network? Does the network switch or vSwitch need to be configured a certain way so the IDS server sees all traffic passing through the network?

Answer 1

You need to select your IDS location based on what you need. If you have a very small network with one switch, then this can be easy, but for a larger network estate there are a few options:

• Gateway: have your IDS connected to your perimeter router/firewall so that you can monitor everything coming in and out of your network. This requires a huuuuge amount of tuning, as there is so much automated stuff trying to gain access.
• Crown Jewels: locate your IDS on the subnet your key assets are on, this way you only see traffic that has got this far - so tuning out false positives should be much simpler. The downside is that you don't see anything else on the network.
• Agents: you can give routers and switches, or even desktops, an agent which feeds into an IDS (often via syslog or other common mechanism) and you can base this on your specific requirements.

Remember the biggest problem with any IDS is keeping it tuned to reject as many false positives as you can while alerting on suspicious traffic - and then having a team respond and assess those alerts. The amount of traffic even on a medium sized network can be incredibly hard to sift through...