D/DoS mitigation hardware/software needed.

jim deleskie deleskie at gmail.com
Tue Jan 5 02:18:28 UTC 2010


What Roland said, I've seen people do this, no rules in place, still
was able to kill the box (firewall) with a single CPU server.

-jim

On Mon, Jan 4, 2010 at 10:04 PM, Dobbins, Roland <rdobbins at arbor.net> wrote:
>
> On Jan 5, 2010, at 4:25 AM, Jeffrey Lyon wrote:
>
>> Use a robust firewall such as a Netscreen in front of your mitigation
>> tool.
>
> Absolutely not - the firewall will fall over due to state-table exhaustion before the mitigation system will.  Firewalls (which have no place in front of servers in the first place), load-balancers, and any other stateful devices should be southbound of the mitigation system.
>
> -----------------------------------------------------------------------
> Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>
>
>    Injustice is relatively easy to bear; what stings is justice.
>
>                        -- H.L. Mencken
>
>
>
>
>




More information about the NANOG mailing list