On Jul 1, 2009, at 11:02 AM, Quinn Mahoney wrote:
irewalls do have features,
for instance, they can proxy a tcp-syn connection and not send it to
the
server if it doesn't get an ack.
Doesn't scale. Server alone handle this much better, even without syn-
cookies.
Also they obviously block traffic, which is a security benefit.
So do stateless ACLs in hardware - much more efficiently.
Also, what if the attack has spoofed source addresses, and is
evasive of
profiling. In other words, what are you going to null route. The
ingress path of the attack packets would have to be traced and cut off
at the border of upstream providers, killing legit traffic as well.
Appropriate detection/classification/traceback tools and S/RTBH handle
most of this; the rest is where intelligent DDoS mitigation
capabilities come into play. Stateful firewalls don't do this, and
the stateful part is what makes them fall down.
An advanced firewall or load balancer (that multiplex's the
connections) would be able to mitigate this attack.
Again, they a) don't do what you're asserting they do and b) don't
scale.
This isn't a matter of opinion, it's a matter of operational
experience and fact. Putting stateful firewalls in front of servers
is both unnecessary and counterproductive.
-----------------------------------------------------------------------
Roland Dobbins <[email protected]> // <http://www.arbornetworks.com>
Unfortunately, inefficiency scales really well.
-- Kevin Lawton
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
