On Sun, Feb 26, 2006 at 11:40:18PM -0800, Angel R wrote:
Dear Bruce,
We've several high performance servers in the data center that each of
their bandwidth usage reachs about 300mbps. Our DataCenter connection to our
users is several Gigbit Ethernet Links and we've no management on users
network. So we've two place to setup our TAPs: the first place is near
servers with about 300mbps and the other place is our connection to users
network with about 400-500mbps each. On both of these places, a single IDS
sensor can not handle the traffic so I need a Load Balancer like appliance
that can balance the traffic to IDS sensors farm.
Please note that I want to analyze all of the traffic and no filter can be
applied on these traffics.
There are IDS load balancers. I have not used them, though a good
googling may get you enough info.
There are other options. Multiple taps or spans with BPF filters, or
ruleset tuning.
<source>
=> IDS configured for HTTP only traffic
=> IDS configured for NFS traffic
=> IDS configured for SMTP only traffic
=> IDS configured for other.
or
<source>
=> BPF for 10.10.12.0/24 (IDS)
=> BPF for 10.10.13.0/24 (IDS)
=> BPF for 10.10.14.0/24 (IDS)
The traffic replication can be done with spans or regeneration taps,
the later being better. The
same sort of filtering can also be done with VACLs, and
Another option is to pass all the traffic through routes intentionaly
segregating traffic by net block
, then add the taps there. Note, the routers'll need to be able to route on
source address or use policy based routing.
Before :
Servers <--------> switch <---> Clients 10.10.12.0/24
|-> Clients 10.10.13.0/24
\-> Clients 10.10.14.0/24
After :
Servers <--> Router Router <-->
switch <---> Clients 10.10.12.0/24
|--> 10.10.12.0/24 bits <--|
|-> Clients 10.10.13.0/24
|--> 10.10.13.0/24 bits <--|
\-> Clients 10.10.14.0/24
\--> 10.10.14.0/24 bits <--/
Then tap between the two routers, or better yet, install an
inline IPS which will automaticly rate limit traffic to the capacity that can
be IDSed. As long as clients and servers are on different networks the clients
need never know they are behind another set of routers / ipses. The traffic
quantites can be to some extent adjusted via routing, or if you'd like through
QOS on your two new routers.
So yes, it is possible to have multiple lower power/speed/whatever
sensors watching a higher traffic link, however there are some nasty corner
cases you'll have to watch out for.
1) Avg speed vs Bursting speed. A gige ethernet can stustain 2
gigabits /sec of traffic, even if the 5 minute average is only 100 Mbits/sec.
Passive IDSes that don't do enough buffering will get flooded and blinded.
Inline fixes that, but impacts users work by slowing the link down when it gets
buisy. The same corner case shows up any where you can make an IDS slow. #
connections /sec, flowtable entries, etc.
2) Depending on how traffic is segregated, you may loose detection.
The simple exmaple is a rate based alarm. If the alarm trips at 12 events
/sec, there are 20 eventes/sec and a single IDS, the alarm will go off. If
there are 3 idses sharing the load, it may not go off. Or it may go off three
times (bursting).
3) Flowbits don't work across IDSes.
Good luck.
-gulfie
Thanks
"Briggs, Bruce" <Bruce.Briggs@suny.edu> wrote: It would be helpful for
you to tell us what you mean by a high traffic rate.
Is it possible to have multiple Snort sensors at lower traffic rate
locations in your network and still cover all traffic flows that you desire
to monitor?
Bruce
---------------------------------
From: snort-users-admin@lists.sourceforge.net
[mailto:snort-users-admin@lists.sourceforge.net] On Behalf Of Angel R
Sent: Sunday, February 26, 2006 7:35 AM
To: snort-users@lists.sourceforge.net
Subject: [Snort-users] IDS Load Balancer
Dear All,
I'm going to start a project to implement an end to end IDS solution in
a data center. My problem is that high traffic rate in the data center leads
me to use an load balancer to balance the traffic to multiple Snort servers.
I'll be thankful if you help me to find a proper [including commercial]
solution.
Thanks all
---------------------------------
Yahoo! Mail
Bring photos to life! New PhotoMail makes sharing a breeze.
---------------------------------
Yahoo! Mail
Use Photomail to share photos without annoying attachments.
-------------------------------------------------------
This SF.Net email is sponsored by xPML, a groundbreaking scripting language
that extends applications into web and mobile media. Attend the live webcast
and join the prime developer group breaking into this new coding territory!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=110944&bid=241720&dat=121642
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
