IDS mailing list archives
RE: IPS technology question.
From: "Palmer, Paul (ISSAtlanta)" <PPalmer () iss net>
Date: Tue, 30 Aug 2005 15:32:27 -0400
Tim, PCI-X is 133MHz, but that translates to 1.06GBps. That is, the bandwidth is slightly over one gigabyte per second, not one gigabit per second. The maximum theoretical bit rate would then be about 8.5 gigabits/sec. If you then consider that the Intel architecture allows for multiple PCI-X busses, bus bandwidth is even less of a bottleneck. Paul -----Original Message----- From: THolman () toplayer com [mailto:THolman () toplayer com] Sent: Tuesday, August 30, 2005 5:23 AM To: dswift () ipolicynetworks com; planz2009 () gmail com; snort.user () gmail com Cc: focus-ids () securityfocus com Subject: RE: IPS technology question. Hi David, A standard PCI bus (PCI-X, 133Mhz) is only capable of 1.06Gbps. This means 530Mbs in, and 530Mbs out, not taking into account things like hard-disks, logging/reporting and any packet inspection, which only serve to pull this number down further. It is architecturally impossible for a standard Intel platform to attain a throughput of anything higher than 530Mbs, let alone the 2Gpbs you claim below? A further explanation of these figures may help clear things up? Regards, Tim -----Original Message----- From: Swift, David [mailto:dswift () ipolicynetworks com] Sent: 24 August 2005 15:36 To: planz; snort user Cc: focus-ids () securityfocus com Subject: RE: IPS technology question. There are varying techniques in achieving performance, and FPGAs/ASICs are not the only way. The company I work for, iPolicy Networks, put the development effort on the front end to optimize rules, signatures, and processing rather than building a better ASIC. We've been able to achieve 140Mbps - 2Gbps on a single standard Intel platform without FPGAs by pre-compiling the rules into a state engine, and pushing them down to an Intel platform. On the high end to reach 4Gbps we used clustered Intel Network Processors. Again, no custom ASICs required, just intelligent parallel processing, and pre-compilation with bounded rules. As to the total number of vendors, Gartner said last year there were over 700 vendors in the security space. And it seems everyone messages the same thing whether or not they can do it. -----Original Message----- From: planz [mailto:planz2009 () gmail com] Sent: Tuesday, August 23, 2005 9:14 PM To: snort user Cc: focus-ids () securityfocus com Subject: Re: IPS technology question. I don't get, what do you mean by "Percentage", since we have uncounted number of vendors/brands of IPS today. If you look at the technology angle, the vendors who are offering both Software and Appliance versions of the same IPS, falls into the first category. To take a look back at the market, we find only very few vendors, like ISS, Snort, Dragon, ...hmmm.. Can somebody help to fill-up the list. Whether it is IDS or IPS, it is important to look at the Detection Technology. If it cannot detect, how can it alert or prevent? In an IPS world, firewall plays behind the scenes; since the IDS is configuring the built-in firewall feature to block. snort user wrote:
Greetings. What percentage of the IPS systems are out there, which does not use co-processors/FPGA etc.. What percentage of the IPS systems depend on firewalls like iptables and ip filter ? I am just trying to get an idea of what is the state of art in the IPS technology space. Any information is appreciated. Thanks -----------------------------------------------------------------------
-
Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to
http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more. -----------------------------------------------------------------------
-
------------------------------------------------------------------------ Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more. ------------------------------------------------------------------------ ------------------------------------------------------------------------ Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more. ------------------------------------------------------------------------ ------------------------------------------------------------------------ Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more. ------------------------------------------------------------------------ ------------------------------------------------------------------------ Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more. ------------------------------------------------------------------------
Current thread:
- Re: IPS technology question., (continued)
- Re: IPS technology question. planz (Aug 23)
- Re: IPS technology question. Pukhraj Singh (Aug 24)
- Re: IPS technology question. Joey Peloquin (Aug 25)
- Re: IPS technology question. Bob Walder (Aug 27)
- Re: IPS technology question. Joey Peloquin (Aug 25)
- Re: IPS technology question. huy tran (Aug 24)
- RE: IPS technology question. Swift, David (Aug 24)
- RE: IPS technology question. THolman (Aug 30)
- Re: IPS technology question. Richard Bejtlich (Aug 30)
- RE: IPS technology question. Swift, David (Aug 30)
- Re: IPS technology question. Jason Wright (Aug 30)
- RE: IPS technology question. Palmer, Paul (ISSAtlanta) (Aug 30)
- RE: IPS technology question. THolman (Aug 31)