--- Mike Barkett <mbarkett@nfr.com> wrote:
The RISC based solution we are discussing is
markedly different in that it has none of the above, and it relies less on
load
balancing than traditional "sandwich" solutions.
OK. From bird?s-eye view, your solution looks like FWLB in a chassi, but this
forum is probably inappropriate place to discuss specifics of the NFR solution.
It's hard to be specific without knowing the details of load balancing.
However, let me try to list a few issues:
- Increased latencies and jitter in case of inline deployment.
- Burst loss. For example, try to do a deep inspection without loss of a >>
large TCP window of a single TCP session sent by a server or a test
device over a gige interface.
What's max burst you can process without loss?
- If traffic from a malicious source is distributed to several CPUs,it
will take you much longer or even impossible to detect the attack and
start dropping malicious traffic.
It's certainly understandable that you'd be skeptical about the numbers
being thrown around. You're not the only one. And it's true that a poorly
Implemented distribution scheme will suffer from the problems you mention.
These are not new concerns, however, and the equipment and software that we
use to tackle the speed problem are specifically designed to handle these
challenges. As someone said on a previous thread (or was it this thread?),
let's wait until the third party numbers come out before passing judgment.
.......
Sure, however let?s keep in mind that the third parties don?t test for spike,
burst latencies and jitter in the IDP testing. See:
http://seclists.org/lists/focus-ids/2006/Feb/0018.html
Jack.
__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com
------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
------------------------------------------------------------------------
