As we previously discussed in Chapter 6, Creating an External Attack Architecture, when we deploy a network-based Intrusion Detection System (IDS), we place a sensor on each segment of the network. The sensor consists of a network card that is placed in promiscuous mode, and this turns the MAC address filtering off. All of the traffic is passed up the stack and to the application that is monitoring the sensor. We also discussed the challenges of deploying sensors on a switch since the traffic is not sent out of all ports, and this can pose a challenge to provide data to the sensor.

With a network-based IDS, the function of the IDS is to process the network traffic at the packet level and then analyze it for characteristics or patterns that might be indications of an attack. As you think about this, keep in mind that the network sensor is capturing packets; so how many packets are traversing the network at any one time? This is one of the challenges of the network...