What Causes Problems With IDS?

• Switches -- require port mirroring

• Encryption -- NIDS cannot decode traffic

• Busy High-Speed (>100Mbs) Networks -- packets may be dropped

• Noise Generators -- 'Stick' and 'Snot'

• False Positives -- lost productivity

• False Negatives -- false sense of security