HP IDS 9000 and packet analysis

[Ron Goodwyn_1]

Is HP IDS 9000 capable of analysing packets of data in realtime? Or does it simply rely on logs and other network activities etc.?

Many Thanks,
Ron Goodwyn

[Pierre Pasturel]

Ron-

IDS/9000 (soon to be renamed Host IDS) does not monitor packets but instead monitors system calls and user logins, logouts, and su.

HP's IPFilter for HP-UX looks at packets in real time, and depending on what you are interested in, someone might be able to look at IPFilter logs to see who was trying to do what. Other possibilities could be to use tcpdump to look at network traffic, or open source Network IDSes like "snort".

See the following for more info:
http://www.hp.com/products1/unix/operating/security/index.html#network
http://www.snort.org/about.html

Pierre

[Steven E. Protter]

As noted no.

There is a package called ethreal, open source that can be installed to do this kind of analysis real time.

Its not an easy install, but it can be done on HP-UX.

http://hpux.connect.org.uk/hppd/hpux/Gtk/Applications/ethereal-0.9.13/

This should do you just fine.

SEP

[Steven Sim Kok Leong]

Hi,

Ethereal should be easier to use than nettl that comes packaged with HP-UX by default.

Hope this helps. Regards.

Steven Sim Kok Leong