RE: Multi-Processor based solutions

[Surya Batchu <suryak_batchu () yahoo com>]

Thank you for the quick answer. Though this approach
works for many deployments, the load balancing may not
be proper i.e some CPUs get overloaded. This
functionality is challenging in multi-functional
devices where some traffic is IPsec'ed and some not.
Also, there may be conflicting requirements such as
overlapping selectors among the traffic anomaly
policies.

In IPsec case, some traffic falling in the traffic
anomaly policy may not go to the same CPU as clear
traffic as IPsec tunnel itself may be owned some other
CPU.

It seems to me that traffic anomaly is at best best
effort in multi-CPU environments.

Any comments...

Surya


--- "Biswas, Proneet" <pbiswas () ipolicynetworks com>
wrote:

> Hi Surya,
>   There could be multiple methods of handling these
> issues based on the
> kind of architecture desired. One of the most common
> methods deployed is
> some kind of load balancing based on the IP tuple.
> Let us say we want to
> handle the case of DoS attacks on particular
> servers. In this case, you
> could direct all packets belonging to a particular
> Destination IP to a
> particular CPU. The other mechanism could be load
> balancing based on
> protocols. Say all traffic anomalies related to HTTP
> are handled on a
> particular CPU. There could be more advanced load
> balancing algorithms
> too.
>
> Thanks
> Proneet.
>
> -----Original Message-----
> From: Surya Batchu [mailto:suryak_batchu () yahoo com] 
> Sent: Wednesday, March 22, 2006 7:04 AM
> To: focus-ids () securityfocus com
> Subject: Multi-Processor based solutions
>
>
> I understand signature based detection and
> prevention
> works fine in Multi processor solutions. Does
> anybody
> have any experience on  traffic anomaly based
> intrusion detection and rate control?  I wonder how 
> effective this would be as different connections
> belonging to a policy may end up in different CPUs.
>    
> Surya
>
>
> __________________________________________________
> Do You Yahoo!?
> Tired of spam?  Yahoo! Mail has the best spam
> protection around 
> http://mail.yahoo.com 
------------------------------------------------------------------------
> Test Your IDS
>
> Is your IDS deployed correctly?
> Find out quickly and easily by testing it 
> with real-world attacks from CORE IMPACT.
> Go to
http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
> to learn more.
------------------------------------------------------------------------
>


__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com 

------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
------------------------------------------------------------------------