Speakers at a recent conference on networking and IDS in Santa Clara, CA, did not waste time either praising or bashing vendors. They focused instead on coming to grips with the failings of IDSs and examining possible solutions. While IDSs should be an important part of any large organization's security framework, they are no more foolproof than the firewalls they often augment. There are two types of IDSs available, and several ways to organize them.
Some systems are host-based, monitoring system event logs for evidence of misuse.
Other systems are network-based, sniffing the network segments that are already watching for misuse. What both systems have in common is that they can only detect the types of attacks that appear in the products' databases of attack signatures. New varieties, as well as minor variations to already recorded attacks, will not be detected or reported. Most attacks are variations on past attacks. More recent attacks, based on buffer overflows of FTP servers used in many different Linux systems, did not come in a single form, but rather in more than five variations.