D/DoS mitigation hardware/software needed.

Sun Jan 10 06:45:50 UTC 2010

On Jan 10, 2010, at 1:27 PM, Roger Marquis wrote:

> Reads like a sales pitch to me.

My employer's products don't compete with firewalls, they *protect* them; if anything, it's in my pecuniary interest to *encourage* firewall deployments, so said firewalls will fall down and need protection, heh.

Teaching people how to design their server farms, harden their network infrastructure, and deploy S/RTBH and flow-spec isn't selling anything.  Only someone with ulterior motives would claim otherwise.

This isn't 'selling' anything, either:

<http://mailman.nanog.org/pipermail/nanog/2010-January/016747.html>

So, this line of attack falls flat, and merely comes across as unjustified, uninformed, foolish and petty.

> Your presentation makes a good case for Arbor-type defenses, against a certain type of attack, but it doesn't
> make the case you're referring to.

S/RTBH and flow-spec aren't 'Arbor-type defenses', and I had a long track record of making the case for all of these things for many years before I ever worked for Arbor.  

> 
> What would convince me is an IXIA on a subnet with ten hosts running a
> db-bound LAMP stack.  Plot the failure points under different loads.
> Then add an ASA or Netscreen and see what fails under the same loads.

Then hop to it.  I did this kind of testing when I worked for the largest manufacturer of firewalls in the world, so I've no need to repeat it.

> Which is basically claiming that the general purpose web server, running
> multiple applications, is more capable of inspecting every incoming packet
> than hardware specifically designed for the task and doing only the task
> it was designed for.

Properly tuned, yes.

Here's the thing; you're simply mistaken, and you hurl insults instead of listening to the multiple people on this thread who have vastly more large-scale Internet experience than you do and who concur with these prescriptions.  That's your prerogative; and it's my prerogative to grow tired repeating the same points which have already been made earlier in this and other threads, when they fall on biased, deaf ears.  If you choose not to read and understand and learn from the broader experiences of others, that's up to you.  I'm done.

-----------------------------------------------------------------------
Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>

    Injustice is relatively easy to bear; what stings is justice.

                        -- H.L. Mencken