Re: Sessions Resource Exhaustion

["Ravi Chunduru" <ravi.is.chunduru () gmail com>]

thank you all for responding. it was really helpful.

even with 500 packets/sec on UDP:500  (with different source ip
addresses),  i could exhaust all states in my SME firewall.  imagine
that this firewall is kept in real network.    by using fraction of
bandwidth about 256kbps, one can shut this network for any outside
communication.        any security device is expected to increase
network protection, but not take it away.

I had some take aways from this discussion. Select security device that provides

* setting idle timeouts based on port number (service).  for UDP:500,
it can be as low as 20 seconds.

* settings to limit number of states for UDP traffic.

* some kind of random drop or session rate policing once session flood
condition is detected.

* higher number of states for a given price point.


thank you again
Ravi





On 10/11/07, Ravi Chunduru <ravi.is.chunduru () gmail com> wrote:
> using simple tools such as hping2 and others, i am able to exhaust
> session resources in some firewall and IPS devices. some firewalls and
> IPS devices addressing small business market segments seems to be
> supporting maximum of 10000 sessions.  these devices are not allowing
> any new connections if all 10000 sessions are used up.
>
> can i say that these devices are vulnerable to simple DoS attacks?
>
> thanks
> Ravi

------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw 
to learn more.
------------------------------------------------------------------------