Re: D/DoS mitigation hardware/software needed.

[Tim Eberhard <xmin0s () gmail com>]

Kinda funny you state that Roland. I know of at least two very large
carriers that uses Netscreens (and soon SRX's) for their DoS/DDoS
mitigation.

State table exhaustion on the netscreen platform is something that is very
easy to protect against with some protections and hasn't been a problem for
years. If you can fill up a session table on a higher end SRX then I would
be very very impressed. I would argue that firewalls place is in fact
directly infront of servers and load balancers to protect them.



On Mon, Jan 4, 2010 at 8:04 PM, Dobbins, Roland <rdobbins () arbor net> wrote:

> On Jan 5, 2010, at 4:25 AM, Jeffrey Lyon wrote:
>
> > Use a robust firewall such as a Netscreen in front of your mitigation
> > tool.
>
> Absolutely not - the firewall will fall over due to state-table exhaustion
> before the mitigation system will.  Firewalls (which have no place in front
> of servers in the first place), load-balancers, and any other stateful
> devices should be southbound of the mitigation system.
>
> -----------------------------------------------------------------------
> Roland Dobbins <rdobbins () arbor net> // <http://www.arbornetworks.com>
>
>    Injustice is relatively easy to bear; what stings is justice.
>
>                        -- H.L. Mencken