> It could be interesting to talk about it, but :
> - it's not much used

yes - it's not much used in the Business world yet, but
it is in the IRC World. Most of the current attack from 20-300
mbps to the dalnet boxes are such attacks.

> - there's not much to do against it

not true, if we start beginning to work together we may could
backtrace those attacks and get this kid into the jail. Law's
can do nothing when we've no proof from where the attack
is coming from and federal laws is taking months of investigations
time. (Yes, we got 4 kids into jail in israel due to packeting).
 
> So unless you get one of the guys involved in the development 
> of IOS, Linux or the *BSD IP stacks, the talk won't go too 
> far... Steve Gibson made it look big, but he's as always 
> making big stories out of small events.

He's realistic. I got some good connections to persons with
good DoS expirience (first.org) but I doubt he'll be able
to make a presentation for us since he lives in US. OR do 
we want to sit together and pay the fligt tickets and the hotel? ;-)
  
> Yes, but also some network hardware companies claims to have 
> means to filter those attacks...

We've 2 x PIX 535 currently in front of the DALnet machines, but
that's not enough... I doubt other hardware will.
 
> It would be very good to compare those products.
> 
> If someone is interested here is a list of the main anti-DDoS 
> companies : Arbor Networks, Asta Networks, Captus Networks, 
> Mazu Networks, Riverhead Networks...
> 
> A "basic" article with more details about their products : 
> http://www.nwfusion.com/buzz2001/antiddos/
> 

Those products mostly detect a DoS, this could also be done
by a good IDS. It may also suggest you router filter configurations
but what bring those when the line is full... We need to work on
the ground of the problem.

If someone got such a product, could you please tell me how good
they really are? How do these products handles big DoS attacks? 
Will the CPU die due to overload? 

-Michael Dornbierer aka Acidli
----------------------------------------------
[EMAIL PROTECTED] Maillist-Archive:
http://www.mail-archive.com/swinog%40swinog.ch/

Reply via email to