News for hackers. Stuff that matters.

A comment on Bro Network Security Monitor. Parent comment

Re:Bro Network Security Monitor by tptacek on Monday June 09, 2014 @01:53PM (#7869535)
No offense, but it's also extremely inaccurate; that is not a good dividing line to draw between the two projects.

The previous Bro thread had a decent comparison between the two projects.

If I was going to deploy a network IDS/IPS somewhere (spoiler: I wouldn't), it'd be Snort. If I was going to monitor a network in general, or do network monitoring research, I'd use Bro.

[ Parent | on HN ]
Re:Bro Network Security Monitor by anonymousDan on Monday June 09, 2014 @02:00PM (#7869577)
Why wouldn't you deploy a network IDS/IPS out of interest? What problems do they have and what would you advise instead?
[ Parent | on HN ]
Re:Bro Network Security Monitor by tptacek on Monday June 09, 2014 @02:13PM (#7869640)
Sometime when we're in an unburied thread and I'm not prepping to travel out of the country the next day, I'll be happy to write a couple thousand words on this. But fair warning, I probably won't say anything you wouldn't expect me to say after reading what I wrote about it back in '98 (Google [insertion evasion]).
[ Parent | on HN ]