I want to propose an architecture of intrusion detection on the schema shown below. Should I place one IDS in front of each server, or would one be sufficient for all the servers?

Architecture schema

4 Answers 4


The main information I get from your question is that you don't know what kind of threats to expect in your network, but nevertheless you hope to address them using some kind of IDS. This will probably fail.

So the first thing would be to make a risk analysis, develop a threat model and then do a cost/benefit analysis to decide which threats should addressed and with which risks you can live. And because the threat landscape is moving you should reevaluate your decisions often enough.

Just an example: If you fear an attacker coming from the outside you could deploy a passive central IDS to detect intrusions. Unfortunately this will not prevent intrusions so they will probably spread through your network and can only be detected with IDS which near the host. Host-based IDS itself might also work unless the attacker is able to disable them once they owned the system. Instead of using passive IDS you might use active components which not only try to detect but also to prevent attacks. You find them usually named as firewalls,IPS, NGFW, UTM, Secure Gateway... . But be aware that none of these will detect and prevent everything, and usually they detect much less than their marketing claims.

And of course you should now on which level you expect the attacks: a simple packet filter will not detect application level attacks and how good something like drive-by-downloads or waterholing attacks with 0-day exploits get detected depends a lot on the capabilities of the IDS/IPS and also a lot on your ability to tune it specific to your environment.

So just don't expect just to put something there and be safe - you probably have to invest lots of money into technologies, but also a lot of knowledge and man-power to maintain the system and keep up with the latest threats.

In summary: there is no clear answer to your problem. Only after you have made an in-depth risk analysis you can decide what the best way would be with the amount of money, man-power and knowledge in your budget.


You could use Host-based IDS on each system. This may already be included in the Anti-Virus software you use. Alternatively, you could have IDS on a span port on the network switch used for the environment. This should monitor all traffic and alert on issues identified.


The IDS needs to go somewhere between the attacker and the target, so that the attacker passes thru it during the attack and triggers the IDS.

There are consequently many places in any network where you could put an IDS. In fact, many organisations end up placing more than one.

Sometimes you want to put it very close to the target. Host-based IDS systems are usually here, hence the name - they sit on the host.

Or, you might want to put it close to the attacker, such as at the perimeter of your network - Network-based IDS systems are often here, but not always. What if the attacker is already inside?

Where you should put your IDS depends on your network structure and on your specific threat model - what are you protecting and who from? Network IDSs are quite broad and can monitor a lot of targets; host-based IDSs are quite narrow, protecting a specific target, but can be more effective for that target since they know the target better.

Also, an IDS adds overhead to your network, and can potentially be a bottleneck, so you have to consider that when placing it.

Lastly, if you'll pardon me for saying so, the network diagram in your question makes absolutely no sense, so you probably need to go back and get that clear in your head before thinking of deploying an IDS.


The best answer would be: both (NIDS and HIDS), according to Defence in depth paradigm.

Of course from some reason it would be impossible (i.e. because of costs). Then you have to choose between them. You haven't given many detailes about your infra, but you can make choice proper solution based on this questions:

  • which kind of servers are on the diagram (Unix/Windows)?
  • commercial or open source?
  • is it possible to install inline NIDS?
  • is it possible to install NIDS on span port?
  • is it possible to install HIDS on servers?

Based on these questions you would probably choose the best solution for your infrastructure. In example, for Unix servers you could install OSSEC HIDS on hosts. Snort is a good solution as NIDS.

EDIT: In case of Unix: please take a look at the Security Onion distribution.

I hope I helped somehow.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .