Re: Large receive offload, good or bad?

[Joel Esler <jesler () sourcefire com>]

Response is from a fellow VRT member who is not on list, but is very smart in these things:


On Aug 30, 2012, at 5:25 AM, elof () sentor se wrote:

> LRO sounds like a good thing - aggregating multiple incoming packets from 
> a single stream into a larger buffer before they are passed higher up the 
> networking stack will reduce CPU overhead.

While it is true that LRO does for the most part reduce the host cpu
overhead, there are a number of other things to consider.

As far as I know, there has been no research into security bugs in the
network cards and their firmware.  Or even into how their reassembly
and de-fragmentation engines deal with common evasion techniques such
as overlapping segments.

There is no way to set the max reassembly size in the network card,
this means that there is no way to ensure that snort does not truncate
a frame during processing.

> If one does not use target-based reassembly in snort,
> can/should LRO be enabled? What's you opinion?

There is no such thing as not using target based reassembly, if you
don't define rules stream5 will use the default reassembly target
(windows in the shipping config).

If I was deploying an I[DP]S I would investigate using a operating
system and network card that supports zero copy bpf sockets. This will
save you much more CPU time than using LRO and have much more
predictable results.


--
Joel Esler
Senior Research Engineer, VRT
OpenSource Community Manager
Sourcefire
------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!