IDS: Real-world experience

[Robert Graham <robert_david_graham@yahoo.com>]

FAQ: See http://www.ticm.com/kb/faq/idsfaq.html
IDS: See http://www-rnks.informatik.tu-cottbus.de/~sobirey/ids.html
HELP: Having problems.. Then email questions to ids-owner@uow.edu.au
NOTE: You MUST remove this line from reply messages as it will be filtered.
SPAM: DO NOT send unsolicted mail to this list.
USUB: email "unsubscribe ids" to majordomo@uow.edu.au
---------------------------------------------------------------------------

--- Eric <eric@gruver.net> wrote:
> I wonder how fast NT 4.0 SP 4 runs on a 486, though.  I guess it
> doesn't matter on a stand-alone machine that is basically a target
> for people breaking into systems.  A slow response time might be
> interpreted as a really busy system and thus make it more interesting.

We use several machines running NT4/sp4 on 486 systems (25Mhz to 66Mhz), as well as Linux boxes on
the same platforms. In all tests (routing, e-mail, web-service, and proxy), the platforms perform
similarly. Things only suck when you open a GUI to administer the machines -- at that point, the
attractiveness of command-line interfaces become apparent (FYI, the GUIs suck even worse on
Windows 2000).

For example, we have an NT proxy server to a 416-kbps link that also runs a network intrusion
detection system. Even under the heaviest load we can put on it, CPU utilization never exceeds
30%. Once you try to open the MMC (Microsoft Management Console), CPU will be pinned at 100% for
about a minute. While it is theoretically possible to administer the box from a command-line,
don't try it at home or you are likely to get hurt.

Rob.




_________________________________________________________
Do You Yahoo!?
Get your free @yahoo.com address at http://mail.yahoo.com