1. What is a “Network Intrusion Detection System (NIDS)"?

2. What is a “Network Intrusion Detection System (NIDS)"? A Network Intrusion Detection System is a system which can identify suspicious patterns in network traffic NIDS is designed to allows Data to be transmitted in Real-Time across any TCP/IP Network or connection, i.e. from any 2 PCs or Wireless Devices to millions, in Real-Time

3. Some of the major features in NIDS in Windows 2000 include: Support for Plug and Play, Power Management, and Windows Management Instrumentation(WMI) Support for connection-oriented media such as asynchronous transfer mode (ATM).

4. Features Support for older (legacy) transport stacks over connection-oriented media (for example, the LAN Emulation (LANE) driver and User Network Interface (UNI) Call Manager). The ability to offload tasks from the TCP/IP transport to the network adapter (for example, TCP/IP checksum tasks, IP Security tasks, and the segmentation of large TCP packets).

5. High performance OS Specific capture module for Linux Packet decode engine fully supports encapsulation Decode plugins included for many protocols

6. Easy to configure; just one config file Full IP defragmentation TCP stateful inspection with window tracking Intelligent TCP stream reassembly Full application layer decodes EXTREMELY fast and scalable signature engine Configurable token-bucket rate- limiting of any alerts

7. Supported Protocols TCP/IP Suite (IPv4,TCP,UDP,ICMP,IGMP) 802.1q (vlan) Can differentiate EthernetII and novell IPX frames Can decode LLC and SNAP IPX, SAP Linux cooked sockets (SLL) in two different formats GRE (generic routing encapsulation) IrDA (infra-red) ARP/Appletalk ARP

8. Planned Features Some performance enhancements Proper remote alerting to central firestorm server Analyst consoles to read data from central server Central management of all configuration from analyst console

9. What happens after a NIDS detects an attack? Reconfigure firewall chime SNMP Trap NT Event syslog send e-mail page Log the attack Save evidence Launch program Terminate the TCP session

10. How can one detect if someone is running a NIDS? A NIDS is essentially a sniffer, so therefore standard sniffer detection techniques can be used. An example would be to do a traceroute against the victim. This will often generate a low-level event in the IDS.

11. NIDS BY Meron Girma Cis. 450 Professor Anrivor