[j-nsp] Juniper ASP/ASM IDS real world?

[Michael Loftis]

I'm really curious about any real world deployment and use of the IDS 
component in the ASPIC/ASModule on the M series (T, J?)...

>From what I can tell, unless you tell it to log all of the drops, you can't 
get it to log the source of the attack, just the destination.  That's fine 
and dandy enough...using SEC or similar could cause it to run over really 
quickly to the management UI and query for the particular problem sources.

To me, the source of the attack is far more important than the destination. 
Dest is important, but not as important as knowing where it came from so 
that aggressive sources can be blocked more permanently or widely than the 
ASM/ASP will do on it's own inside of the IDS service.

To that end, is anyone out there deploying this in a real world scenario? 
Heck even lab experience would be nice to hear about too.

I googled the archives but didn't seem to find anything relevant.

--
"Genius might be described as a supreme capacity for getting its possessors
into trouble of all kinds."
-- Samuel Butler