Re: ASIC Based IPS

[Barrett G.Lyon <blyon () prolexic com>]

Richard,

Myself and my team have programming on CloudSheild's IDE for a good 6 
months now.  We have been doing very complicated processes at line-rate 
and we are able to do nearly anything we can think of with the packet.  
It's a heavy learning curve and a lot of nuances to pick-up, but for 
the most part -- a good platform.  I'm sure the CS guys would thank me 
for that comment ;)

The 10k foot view of the device: Under the hood they have a bunch of 
NPs that feed into FPGAs that glue together a lot of ASIC based tools.  
So when you code, you can use an ASIC like it is a function in your 
program.  It also has an on-board PC so you can interact with the 
network with any scripting/code you can think of, it's a lot of fun.

Our (Prolexic's) network takes a pretty heavy load (1-10+ Million PPS) 
from time-to-time, and if our network did not perform we would have a 
customer retention problem -- we built one of the first securenet/IPN 
(Intrusion Prevention Networks)  So when you are making things that are 
"out of the box", it's hard to buy something that fits perfectly within 
your specifications.

Along with IPS in general, I think a lot of the devices out there have 
some pretty good rate-limiting and SYN flood mitigation, however, they 
all seemed to miscalculate the sheer amount of processing power it 
takes to do deep packet inspections and protocol verification.  Our 
network is currently representing about 10 Terahertz of processing 
ability just for the DPI, so hoping a single FPGA based hardware device 
will do the trick may be a bad idea.  Also, most devices can not handle 
out-of-state TCP based attacks (see: Riverhead), so keep your eyes out 
on that too.

-Barrett


Barrett G. Lyon
Chief Technology Officer
Prolexic Technologies - The leaders in DDoS Security!


--------------------------------------------------------------------------
Stop hurting your network!

The NeVO passive vulnerability sensor continuously finds vulnerabilities, 
applications and new hosts without the need for network scanning. 
It also finds compromised systems with application-based intrusion detection. 
Go to http://www.tenablesecurity.com/products/nevo.shtml to learn more.
--------------------------------------------------------------------------