IDS comparison article

from the article:
"Snort lacks any kind of intuitive management and configuration interface, relying exclusively on command-line syntax and text-based configuration files. This makes Snort all but unintelligible unless you have a deep background as a developer."

That's ridiculous. Don't fear the command line. You don't have to have [b]any[/b] experience as a "developer" to become quite proficient with the command line. Command line operations often provide a greater flexibility and power with system and network utilities than the GUI can dream of providing, and many people suckled on Windows will never realize this simply because they've been indoctrinated from day one to think of the CLI (command line interface) as "obsolete", "hard", "arcane", or "advanced".

Truthfully, I think the guy that wrote this article just doesn't know what a "developer" actually is, and probably is under the impression that anything dealing with text other than a word processor is automatically "developer" work. He must live within a very sheltered computing environment. He's probably the guy for whom the "see your network administrator for help" messages on Windows were designed.

He also seems to be under the (mistaken) impression that there's no such thing as useful, reliable, generally accessible tech support for software unless you can get it from the software's vendor, which makes things difficult when a given piece of software doesn't have a vendor. There are a number of places you can get good help, for free or for a fee, with implementing open source solutions like Snort.

Setting up IDS properly, so that you get full value for it, is never a "plug and play" operation, no matter what IDS alternative you want to use. This is in large part because every context for IDS must be evaluated on its own characteristics to determine the most effective implementation. If you're the type that can't do something like this, or is afraid to, or just won't, unless it's just a simple drop-in solution, you should contract a consultancy or other solution provider to come in and set up your IDS for you, or otherwise get someone that knows the ins and outs intimately, to do it for you. At that point, which one you choose shouldn't rely at all on how easy it is for you to set up, since you won't be setting it up.

I really can't get over the way he harps on the supposed "drawbacks" of open source software, meaning of course the fact that it doesn't have a single vendor source. That's utterly ridiculous. There are both (paid) support providers a-plenty out there (including solution providers like consultancies and OS vendors), and (free) community support sources. Considering that the overall Linux user community has actually been "awarded" recognition by major IT publications as an effective and helpful support "organization", I think the author of this article is missing some very important points in regards to OSS solutions. If you ever want to really have the best tech support of your life, start using Linux-based solutions and sign up on two or three LUG (Linux User Group) mailing lists. That is bar none the best tech support I've ever had, compared against everything from first-tier helpdesk to major corporate support accounts.

By the way, Demarc Sentarus is essentially a web-based administrative tool laid over Snort. You can get equivalent functionality by simply installing the open source Webmin and its Snort module. How one would do this varies from distribution to distribution, but in Debian GNU/Linux, it need be no more difficult than going to the command line and typing "apt-get install webmin-snort" (without quotes). In fact, doing this will automatically install Snort, too, because apt-get will automatically install all software that a given software package requires, if you want it to.

A great deal of familiarity with the Windows way of doing things, and a lack of familiarity with the Unix way of doing things, will often lead someone to make the mistakes that the author of that article did. His mistakes are, basically, centered around the fact that he doesn't know how easy a lot of things can be if he doesn't assume they can only be easy if they work the way they would on Windows.

When you're as familiar with the ways of Unix as you are with those of Windows, the Unix way is often much easier. People tend to fear the unfamiliar, however, and small lacks of knowledge can get blown all out of proportion as a result. I had to constantly fight the tendency to do just that when I first began learning how to make use of Linux.

By the way, something he didn't mention is that you can get a trial version of Sentarus from the website. If you're dead-set on a drop-in solution with vendor support, you can at least try Sentarus out before committing to buying it.