I am studying IDPs and I would like to know where network-based IDPS sensors can be placed in the segments of the network of the university organization. I am looking forward to analyse different scenarios of sensor placements and the benefits for each one. Can anyone give a suggestion? Thanks in advance!

  • you place them near the traffic you want to monitor. – atk Jun 24 '17 at 0:16

It really depends on the network layout, and what you want to monitor. Is the inbound or outbound traffic more interesting to you?

For bigger organizations, that probably have several offices, and server/infrastructure networks it makes sense to have dedicated sensors with a network specific configuration.

Traditional NIDS (Passive Mode)

I'd put it on a mirror port of the core of that network segment. Make sure that your hardware (NICs, switches) can handle that. For sensor reliability I would look into getting two network cards and setup bonding.

Traditional NID(P)S (In-line Mode)

The traditional setup I often come across is that the sensor itself acts as a router and handles all the traffic coming in and out. So it would be the second hop on the network for outbound connectivity, 2nd to last for inbound. There is a lot of design considerations that has to be done here to not compromise the reliability (additional packet loss), availability of the network, such as a fail-over when the sensor goes down, unintentionally or during maintenance.

This one is hard to scale, and you have to take software and hardware configuration very seriously, only enable features and rules that applies to your threat model.

A good alternative is to go for the passive route and write an agent that triggers action on certain events, such as connecting to the firewall/router/DNS server etc, and applying rules. This way you would get the same effect with less risk of compromising the availability of your network. There is some (old) software known as SnortSAM that may serve as a good example on how to achieve this.

Good reads

Emerging Threats - SnortSAM summary

SANS Institute - How to place IDS sensor in redundant networks

Strategic Sensor Placement for Intrusion Detection in Network-Based_IDS

I hope you find this helpful, feel free to ask any follow up questions. I'm very interested and trying to keep up within the Network Security Monitoring field myself, so the pleasure is mine :)

  • 1
    Thank you very much !!! Your explanation was very helpful! What about IPS ? Could it be the same approach ? – Sindi B Jun 25 '17 at 11:37
  • Sure, my answer for 'NIDPS' (Network Intrustion Detection (and) Protection System) applies to 'IPS' as well. – William Sandin Oct 27 '17 at 13:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.