We installed the Stealthwatch 4.2 appliance in a live production network. We used two different instances of an unpatched Red Hat 7.3 server for our tests, initially with default services enabled and then with just SSH. We used a generic Pentium-based tower PC as a test target in the "inside" zone monitored by the device.
We used Internet Explorer running on a Windows XP system to drive the Stealthwatch GUI, and set up a stock syslog server on a Fedora Core 1 box as the syslog host. Both the IDS and the test target server were attached to a hub along with other systems, so that DNS, SSH, Web, and email traffic was flowing past the IDS, although not through the test target server.
We ran this configuration for several days and performed a conventional (default options) set of NMAP and Nessus scans to induce known attack traffic. We used Metasploit to attack known vulnerabilities (Samba and PPTPD) and 'Brutessh2' to attack the SSH daemon on the test target server.
Back to Clear Choice Test: Network Intrusion-Detection Systems
