On Jul 1, 2009, at 2:05 PM, Quinn Mahoney wrote:
That's not saying a whole lot. You could always get more bandwidth
and
more servers. That doesn't mean it's not helpful to have a
specialized
device multiplexing the connections to the servers, and doing more
sophisticated analysis of the packets before sending them to the
server.
On the contrary, it's absolutely detrimental to attempt to perform
such analysis on a device which is yet another attack vector, and
which can easily be overwhelmed due to its limited stateful capacity
(multiplexing is useful, but is unrelated to this general topic).
I speak from personal hands-on operational experience, and from the
personal hands-on operational experience of others who with whom I've
worked in this sector.
"You are claiming that certain firewalls/load-balancers can't firewall
and inspect packets at millions of packets per second. This claim is
inconsistent with current data.
I know how these devices work from the inside-out, having utilized,
deployed, and participated in feature specifications for same. They
don't do what you claim, and can't ever, due to their inherent design
principles.
These packets are the same as legit packets, I do not believe a fully
effective automated system exists.
My hands-on personal operational experience detecting, classifying,
tracing back, and mitigating multi-gb/sec, multi-mpps DDoS attacks
using precisely the approaches I've outlined indicate otherwise.
Not really saying a whole lot again. My argument was not that the
products you refer to aren't a part of an effective security solution.
My arguments are based on large-scale operational experience and
detailed knowledge of this topic and of the performance envelopes/
characteristics of these types of devices in real-world situations, as
well as from a design and development perspective. They are factual,
and represent ground truth, not opinions.
-----------------------------------------------------------------------
Roland Dobbins <[email protected]> // <http://www.arbornetworks.com>
Unfortunately, inefficiency scales really well.
-- Kevin Lawton
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
