Hi Surya, There could be multiple methods of handling these issues based on the kind of architecture desired. One of the most common methods deployed is some kind of load balancing based on the IP tuple. Let us say we want to handle the case of DoS attacks on particular servers. In this case, you could direct all packets belonging to a particular Destination IP to a particular CPU. The other mechanism could be load balancing based on protocols. Say all traffic anomalies related to HTTP are handled on a particular CPU. There could be more advanced load balancing algorithms too.
Thanks Proneet. -----Original Message----- From: Surya Batchu [mailto:[EMAIL PROTECTED] Sent: Wednesday, March 22, 2006 7:04 AM To: [email protected] Subject: Multi-Processor based solutions I understand signature based detection and prevention works fine in Multi processor solutions. Does anybody have any experience on traffic anomaly based intrusion detection and rate control? I wonder how effective this would be as different connections belonging to a policy may end up in different CPUs. Surya __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com ------------------------------------------------------------------------ Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more. ------------------------------------------------------------------------ ------------------------------------------------------------------------ Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more. ------------------------------------------------------------------------
