Checkpoint IPS

Fri Feb 6 16:31:54 UTC 2015

On 6 Feb 2015, at 23:23, Darden, Patrick wrote:

> And when  your opinion is an acknowledged universal constant, I will 
> tip my hat to you.

It's been a constant for the last couple of decades - I can't count the 
number of times I've been involved in mitigating penny-ante DDoS attacks 
which succeeded *solely* due to state exhaustion on stateful firewalls, 
'IPS' devices, and load-balancers.

I've seen a 20gb/sec commercial stateful firewall taken down by a 
3mb/sec spoofed SYN-flood.

I've seen a 10gb/sec commercial load-balancer taken down by 60 second at 
6kpps - yes, 6kpps - of HOIC.

And so on, and so forth.

'Dismiss' it all you like, but it's a real issue, as others on this list 
know from bitter experience.

-----------------------------------
Roland Dobbins <rdobbins at arbor.net>