After Lancope's StealthWatch G1 intrusion detection appliance won eWeek and PC Magazine's i3 Awards Security category at NetWorld+Interop, I met with the original author of the software, Lancope Chairman John Copeland, to see the technology for myself.
After Lancopes StealthWatch G1 intrusion detection appliance won eWeek and PC Magazines i3 Awards Security category at NetWorld+Interop, I met with the original author of the software, Lancope Chairman John Copeland, to see the technology for myself.
New in StealthWatch 2.0, which started shipping last month, is the ability to set alarm policies that allow specified servers to communicate with a specified, trusted range of client IP addresses without alarms; connections from any other clients raise alarms. A corporation can now set policies that treat internal desktop IP addresses differently from those of VPN clients or outside IP addresses, for example.
StealthWatch uses two techniques to flag possible attackers. First, it detects port scans and unusual or illegal IP packet flag settings and marks sending hosts as possibly dangerous. If one of these hosts then follows up with a larger data transfer to a probed machine, its flagged as a possible follow-on attack.
Second, StealthWatch tracks the ports used by all machines to send and receive data (its as much a network mapping and monitoring device as an IDS). StealthWatch then builds a cross-network profile during a learning phase. This enables it to determine which ports are sending or receiving traffic from the client and server machines during normal operation.
When switched into alarm mode, the software will detect changes if, say, a client system suddenly starts accepting traffic from other clients (evidence of a possible unauthorized Web server installation or a running Trojan) or if a server starts listening on a new port (evidence of a possible root kit).
It wont catch nonscanning attacks against ports on systems already classified as serversoutside Web servers, for example. For these, signature-based systems are needed.
Because StealthWatch is a stateless device and doesnt look deep into packets (it reads only down to the header of the transport layer), it is much faster than other IDS systemsthe $35,000 G1 version can monitor gigabit links, and the $20,000 M100 version can handle links as fast as 100M bps.
Timothy Dyck is a Senior Analyst with eWEEK Labs. He has been testing and reviewing application server, database and middleware products and technologies for eWEEK since 1996. Prior to joining eWEEK, he worked at the LAN and WAN network operations center for a large telecommunications firm, in operating systems and development tools technical marketing for a large software company and in the IT department at a government agency. He has an honors bachelors degree of mathematics in computer science from the University of Waterloo in Waterloo, Ontario, Canada, and a masters of arts degree in journalism from the University of Western Ontario in London, Ontario, Canada.