Can simultaneously using 2 or more intrusion detection systems (IDS) on the same computer or network create conflicts ?
Talking about tools (as examples) such as but not limited to: tripwire, bro, aide, psad, rkhunter.
Thanks !
-
1If you are 'detecting', then I can't see what would be conflicting. If you are 'preventing' (IPS) then you could end up with "response race conditions", but it depends how you implement the IPS's (serial or parallel).– schroeder ♦Mar 23, 2017 at 10:36
-
@schroeder indeed it makes sense haha. I'm talking about an intrusion detection not preventing. What are examples of an IPS please ? Is a firewall an IPS ? Thanks !– MFJCMar 27, 2017 at 11:57
Add a comment
|
1 Answer
Yes, according to my research you can use multiple IDS on the same computer simultaneously.
If you are paranoid and have sufficient free time to read all the email, you will be happy to hear that multiple HIDS tools running in parallel do not get in each other's way. In other words, you can run a combination of Tripwire, AIDE, AFICK, Samhain, and OSSEC on a single computer and let the systems monitor one another. But some caution is advised: Updates that arrive at the same time can easily send the system into an infinite loop. http://www.linux-magazine.com/Issues/2016/183/Host-Based-IDS/(offset)/3#article_i4
