hi - need a sanity check - we have a dead IDS sensor. that sensor normally talks to MARS server 1.
while being replaced, in the interim, the suggestion was made to utilize an unused interface on another IDS sensor (this one currently talks to MARS server 2).
the end result would be 2 distinct MARS boxes trying to pull logs from the same IDS, which would be sniffing traffic on multiple interfaces until the replacement IDS unit is installed. Assuming a lot of reconfiguration on the MARS side to accomodate the temporary setup, but beyond that, is it even possible to do this? I would think the MARS boxes would potentially conflict when connecting to the IDS and copying logs?