RE: IPS technology question.

[THolman () toplayer com]

Thanks for the clarification - I was indeed a factor of 8 out...  :)


-----Original Message-----
From: Swift, David [mailto:dswift () ipolicynetworks com] 
Sent: 30 August 2005 15:23
To: THolman () toplayer com; planz2009 () gmail com; snort.user () gmail com
Cc: focus-ids () securityfocus com
Subject: RE: IPS technology question.

You're a bit off on your PCI specs, and failing to translate bytes to
bits.

http://www.intel.com/design/bridge/prodbrf/25291702.pdf

Most are in Mega Bytes (versus NIC's in Megabits).

Even older generation 64bit/66Mhz slots supported up to 528
MegaBytes/second. Intel claims up to 2.5GigaBytes/second, and X2 and X4
can push that on the 133Mhz busses beyond the performance requirements
of any NIC.

Testing I did a few years back while working on Fibre Channel boards
were showing results peaking at 400MB/s on the 528MB/s rated slots.
Still this translates to 3.2Gbps, and I'm sure they improved.

Regardless, our current limitation on an Intel single CPU system has
been 2Gbps, and on clustered network processors we can achieve 4Gbps.

However, some of these limitations are part of why we (and others), have
been slow to adopt 10GigE. The 1.25GB transfer rate required is a gating
factor, and designs require dedicated busses per card.

-----Original Message-----
From: THolman () toplayer com [mailto:THolman () toplayer com] 
Sent: Tuesday, August 30, 2005 4:23 AM
To: Swift, David; planz2009 () gmail com; snort.user () gmail com
Cc: focus-ids () securityfocus com
Subject: RE: IPS technology question.

Hi David,

A standard PCI bus (PCI-X, 133Mhz) is only capable of 1.06Gbps.  This
means
530Mbs in, and 530Mbs out, not taking into account things like
hard-disks,
logging/reporting and any packet inspection, which only serve to pull
this
number down further.

- Incorrect. X2 and X4 133Mhz chips are available. But this is
misleading, as I have not yet seen a PCI card use those capabilities.

It is architecturally impossible for a standard Intel platform to attain
a
throughput of anything higher than 530Mbs, let alone the 2Gpbs you claim
below?

- Incorrect, and inaccurate. 528MB/s is the 64bit/66Mhz spec, 133Mhz
slots are available (and many systems are multi-bus). And in terms of
Bits/second you must multiply bytes by 8 bits for over 4Gbps on a single
slot/bus limit.

A further explanation of these figures may help clear things up?

Regards,

Tim


-----Original Message-----
From: Swift, David [mailto:dswift () ipolicynetworks com] 
Sent: 24 August 2005 15:36
To: planz; snort user
Cc: focus-ids () securityfocus com
Subject: RE: IPS technology question.

There are varying techniques in achieving performance, and FPGAs/ASICs
are not the only way.

The company I work for, iPolicy Networks, put the development effort on
the front end to optimize rules, signatures, and processing rather than
building a better ASIC. We've been able to achieve 140Mbps - 2Gbps on a
single standard Intel platform without FPGAs by pre-compiling the rules
into a state engine, and pushing them down to an Intel platform.

On the high end to reach 4Gbps we used clustered Intel Network
Processors. Again, no custom ASICs required, just intelligent parallel
processing, and pre-compilation with bounded rules.

As to the total number of vendors, Gartner said last year there were
over 700 vendors in the security space. And it seems everyone messages
the same thing whether or not they can do it.

-----Original Message-----
From: planz [mailto:planz2009 () gmail com] 
Sent: Tuesday, August 23, 2005 9:14 PM
To: snort user
Cc: focus-ids () securityfocus com
Subject: Re: IPS technology question.

I don't get, what do you mean by "Percentage", since we have uncounted 
number of vendors/brands of IPS today.

If you look at the technology angle, the vendors who are offering both 
Software and Appliance versions of the same IPS, falls into the first 
category. To take a look back at the market, we find only very few 
vendors, like ISS, Snort, Dragon, ...hmmm..  Can somebody help to 
fill-up the list.

Whether it is IDS or IPS, it is important to look at the Detection 
Technology. If it cannot detect, how can it alert or prevent?

In an IPS world, firewall plays behind the scenes;  since the IDS is 
configuring the built-in firewall feature to block.


snort user wrote:

> Greetings.
>
> What percentage of the IPS systems are out there, which does not use
> co-processors/FPGA etc..
>
> What percentage of the IPS systems depend on firewalls like iptables
> and ip filter ?
>
> I am just trying to get an idea of what is the state of art in the IPS
> technology space.
>
> Any information is appreciated.
>
> Thanks
>
> -----------------------------------------------------------------------
-
> Test Your IDS
>
> Is your IDS deployed correctly?
> Find out quickly and easily by testing it 
> with real-world attacks from CORE IMPACT.
> Go to
http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
> to learn more.
> -----------------------------------------------------------------------
-
>  


------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708

to learn more.
------------------------------------------------------------------------


------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708

to learn more.
------------------------------------------------------------------------

------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
------------------------------------------------------------------------