I was wondering what your experience and/or thoughts are on whether we should use a Cisco Catalyst 6500 IDS Card or Snort Sensors. Our network consists of 60 servers and 500 end users.
Good question. However, it is unanswerable without a lot more information about your environment. We typically spend a day or two looking at requiements before making a recommendation on something like this. That said, both products are fantastic. Their speed is wonderful, and the management interfaces are both pretty good. I think the question hinges on your prior experience with IDS in your environment and your budget. If you have no IDS experience and/or a limited budget, download the free version of Snort and experiment with one or two sensores for two months. If you like what you see, go with more free Snort or a commercial version of Snort such as that available from www.sourcefire.com. If you don't like what you see, try the Cisco IDS card. If you have a lot of experience with IDS, you should be able to make the call as to whether the Cisco product will meet your needs up front. By the way, another item to consider is that the Cisco IDS card requires, of course, a Cisco switch. If you have any LANs that aren't Cisco, you'll either have to use another solution or leave IDS off of that network. So, make sure to carefully consider Snort if you have a mixed network.
For more information on this topic, visit these other SearchSecurity.com resources: