3 ms·
analysis, IDS, etc. The inability to analyze traffic at this rate is a serious problem. How do you study it to see how protocols can be improved? A lab environ
by feld 10y ago
analysis, IDS, etc.
The inability to analyze traffic at this rate is a serious problem. How do you study it to see how protocols can be improved? A lab environment cannot compare to real world traffic. How do you detect attacks (not DoS!) if it's hidden in a link operating at this capacity?
- user5994461 10y agoEven if you can capture the traffic at wire speed, the CPU doesn't have the power to analyse the stream. I thought that traffic analysers had to be done with FPGA/ASIC because of that.
- feld 10y agoMy manager did his thesis on this. Endace NICs, split traffic up and send to a cluster of IDS servers. Allows you to actually do line rate analysis. No need for FPGA/ASIC.