[Dailydave] halvar, record gigabit networking? IDS for forensics?

[David J. Bianco]

Gadi Evron wrote:

> It sounds cool, but all I can really say having worked in such
> enviroments is "right", cynically. More useful than IDS for sure, though,
> if what you want is forensics (and actually have a way to sort through
> this if it really works and if it really catches everything - not to
> mention if my network is even that centralized)
> 

We've been doing exactly this for years.  Of course, we've been using
Sguil and not the time machine, but the idea is the same, and it's
quite effective.  As you mentioned, it's great for forensics, but it's
best when combined with an IDS.  It's pretty easy to validate most alerts
when you have the raw traffic to fall back on.

Nice to see another addition to the Network Security Monitoring arsenal!

	David