IDS: Re: IDS\IPS that can handle one Gig

[James Blake <jblake () tippingpoint com>]

In-Reply-To: <BAY103-DAV2CDA0AE7EB5D8601EB25EBA080 () phx gbl>

> From: "Randall Jarrell" <rgj () msn com>
> To: <focus-ids () securityfocus com>
> Subject: IDS\IPS that can handle one Gig
> Date: Thu, 19 May 2005 08:28:13 -0700
>
> We are currently evaluating IDS\IPS vendors. We have tried two 
vendors, whom
> I will not name unless you ask me, that have made claims that they 
can
> handle a Gig of through put but actually start to fail around the 
300-500MB
> range.
>
> Could anyone share a success story of a vendor they are using that is
> handling this type of traffic?
>
> Thanks in advance,
>
> -RGJ
As Kos mentions in a follow-up posting below, TippingPoint have a 
range of products that cover from 50 Mbps to 5 Gbps aggregate 
bandwidth (they apply the filters in both directions, so you can have 5 
Gbps total).  The 2400 appliance will do the job.

I hear what you are saying about IPSes either failing open or failing 
closed when you start to push them to their limits.  This is mainly due 
to the fact that a lot of them are extensions of IDS architectures, and 
IDSes were designed to take all the time in the world analysing as no 
real-time decisions needed to be taken.  IPSes on the other hand 
require very quick decisions, so any form of buffering increases the 
latency (so much so that under strain some time-sensitive applications 
like Fibre Channel over IP, Ethernet Encapsulated Fibre Channel and 
VoIP can fail), also any architecture with buffering is open to DoS.

Have a look at http://tomahawk.sourceforge.net - this is an Open 
Source project that TippingPoint released.   It allows you to build a PC-
based IPS testing engine that can pump out about 300 Mbps, the 
architecture allows you to strap multiple Tomahawks together so you 
can push the capacity well above 1 Gbps.  TippingPoint released this 
into the public domain so that coders can see the test are not rigged, 
but anyone is free to use this tool to push any IPS they are evaluating 
over 1 Gbps and see how it reacts.

I would recommend having a look at the TippingPoint appliances, but I 
would as I am their Senior Sales Engineer for the UK ;-)

Good luck with the testing!



James

--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from 
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
--------------------------------------------------------------------------