Thank you for the quick answer. Though this approach works for many deployments, the load balancing may not be proper i.e some CPUs get overloaded. This functionality is challenging in multi-functional devices where some traffic is IPsec'ed and some not. Also, there may be conflicting requirements such as overlapping selectors among the traffic anomaly policies.
In IPsec case, some traffic falling in the traffic anomaly policy may not go to the same CPU as clear traffic as IPsec tunnel itself may be owned some other CPU. It seems to me that traffic anomaly is at best best effort in multi-CPU environments. Any comments... Surya --- "Biswas, Proneet" <[EMAIL PROTECTED]> wrote: > Hi Surya, > There could be multiple methods of handling these > issues based on the > kind of architecture desired. One of the most common > methods deployed is > some kind of load balancing based on the IP tuple. > Let us say we want to > handle the case of DoS attacks on particular > servers. In this case, you > could direct all packets belonging to a particular > Destination IP to a > particular CPU. The other mechanism could be load > balancing based on > protocols. Say all traffic anomalies related to HTTP > are handled on a > particular CPU. There could be more advanced load > balancing algorithms > too. > > Thanks > Proneet. > > -----Original Message----- > From: Surya Batchu [mailto:[EMAIL PROTECTED] > Sent: Wednesday, March 22, 2006 7:04 AM > To: [email protected] > Subject: Multi-Processor based solutions > > > I understand signature based detection and > prevention > works fine in Multi processor solutions. Does > anybody > have any experience on traffic anomaly based > intrusion detection and rate control? I wonder how > effective this would be as different connections > belonging to a policy may end up in different CPUs. > > Surya > > > __________________________________________________ > Do You Yahoo!? > Tired of spam? Yahoo! Mail has the best spam > protection around > http://mail.yahoo.com > > ------------------------------------------------------------------------ > Test Your IDS > > Is your IDS deployed correctly? > Find out quickly and easily by testing it > with real-world attacks from CORE IMPACT. > Go to > http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 > > to learn more. > ------------------------------------------------------------------------ > > __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com ------------------------------------------------------------------------ Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more. ------------------------------------------------------------------------
