[106138] in North American Network Operators' Group
Re: Software router state of the art
daemon@ATHENA.MIT.EDU (Wes Young)
Wed Jul 23 15:05:44 2008
From: Wes Young <wcyoung@buffalo.edu>
To: "Christopher Morrow" <morrowc.lists@gmail.com>
In-Reply-To: <75cb24520807231121j709ad4fahb9ccd38676bec358@mail.gmail.com>
Date: Wed, 23 Jul 2008 15:05:30 -0400
Cc: nanog@merit.edu
Errors-To: nanog-bounces@nanog.org
--Apple-Mail-7-162045801
Content-Type: text/plain;
charset=US-ASCII;
format=flowed;
delsp=yes
Content-Transfer-Encoding: 7bit
We use them here and there (the 1Gig versions). The biggest thing to
think about is the types of rule-sets you'll be using compounded by
the number of flows being created / expired. Once tuned, they work
quite well, but the balance is how fast you can pull/analyze out of
RAM. Compiling the rules down to the card's level speeds things up a
bit, but at the loss of using more dynamic rulesets.
If you can get the raw data to some sort of larger medium (say,
rotating pcaps on a disk), you length the buffer-window. FWIW however,
probably the best way to scale this is get an Xport fiber regen tap,
populate with a few of these, tune them to monitor different segments
based on address space or port ranges. You'll have yourself a
relatively cheap solution, but extremely effective solution.
I've yet to test out the NinjaProbes... It's on my todo list...
On Jul 23, 2008, at 2:21 PM, Christopher Morrow wrote:
> On Wed, Jul 23, 2008 at 11:05 AM, Naveen Nathan <naveen@calpop.com>
> wrote:
>>> The Endace DAG cards claim they can move 7 gbps over a PCI-X bus
>>> from
>>> the NIC to main DRAM. They claim a full 10gbps on a PCIE bus.
>>
>> I wonder, has anyone heard of this used for IDS? I've been looking at
>> building a commodity SNORT solution, and wondering if a powerful
>> network
>> card will help, or would the bottleneck be in processing the
>> packets and
>> overhead from the OS?
>
> http://www.endace.com/our-products/ninja-appliances/NinjaProbe-NIDS
>
> snort at 1g & 10g
>
> -chris
>
--
Wes Young
Network Security Analyst
CIT - University at Buffalo
http://claimid.com/saxjazman9
--Apple-Mail-7-162045801
Content-Disposition: attachment;
filename=smime.p7s
Content-Type: application/pkcs7-signature;
name=smime.p7s
Content-Transfer-Encoding: base64
MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIGPjCCAvcw
ggJgoAMCAQICEGM/0V6419C0cZXhdH8bwIowDQYJKoZIhvcNAQEFBQAwYjELMAkGA1UEBhMCWkEx
JTAjBgNVBAoTHFRoYXd0ZSBDb25zdWx0aW5nIChQdHkpIEx0ZC4xLDAqBgNVBAMTI1RoYXd0ZSBQ
ZXJzb25hbCBGcmVlbWFpbCBJc3N1aW5nIENBMB4XDTA4MDYwNjIxNDcxN1oXDTA5MDYwNjIxNDcx
N1owXDEOMAwGA1UEBBMFWW91bmcxDzANBgNVBCoTBldlc2xleTEVMBMGA1UEAxMMV2VzbGV5IFlv
dW5nMSIwIAYJKoZIhvcNAQkBFhN3Y3lvdW5nQGJ1ZmZhbG8uZWR1MIIBIjANBgkqhkiG9w0BAQEF
AAOCAQ8AMIIBCgKCAQEAu/4T8/9wg44R+t8GdB6dE9Js7EaQbSqonE1OPpQGwaNygoKJxGhJgSlH
uRNcBOTv9D9WmHGLOPuuPk+RdpPGNrpONMOwxkJoGh/oGkvfW6OBxjeGcukWWchCf6zer4AweUOd
I7AXKrZ6MNiqQNNOaaCGYEd/yYntO6XQfYInjVsfwTpxdonU0xL+zRzfwhml1WMkLJ3S6O3cv1IM
lAL9ZeAhQBGkHdsELEnY31vzS8D+d5QWUvBemT/EDrCuZpngG9opytJvBt1u1qrxeuZaE3aBPfOQ
D9uP4lj5mWVXbIv/FH+QTwvkCBx/0XaIKzhiCeo35owBg+kMUf2giUvPvwIDAQABozAwLjAeBgNV
HREEFzAVgRN3Y3lvdW5nQGJ1ZmZhbG8uZWR1MAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQEFBQAD
gYEAig22VsKetXTvz+lmje3RECGcP+rxkZJR5PLcYVWiFBRSJtu4NfHSoqxwKEGkY8rUqSwBOD5K
ozUctG7ibjOmdnCMlyocz2pAXWKQ9w2MqImmX6qDNgUfmrcZ1ODkkJpIo3ro30VVzy6BnPYLIzEC
K/2q4IDjavC84zWlsBPfXpEwggM/MIICqKADAgECAgENMA0GCSqGSIb3DQEBBQUAMIHRMQswCQYD
VQQGEwJaQTEVMBMGA1UECBMMV2VzdGVybiBDYXBlMRIwEAYDVQQHEwlDYXBlIFRvd24xGjAYBgNV
BAoTEVRoYXd0ZSBDb25zdWx0aW5nMSgwJgYDVQQLEx9DZXJ0aWZpY2F0aW9uIFNlcnZpY2VzIERp
dmlzaW9uMSQwIgYDVQQDExtUaGF3dGUgUGVyc29uYWwgRnJlZW1haWwgQ0ExKzApBgkqhkiG9w0B
CQEWHHBlcnNvbmFsLWZyZWVtYWlsQHRoYXd0ZS5jb20wHhcNMDMwNzE3MDAwMDAwWhcNMTMwNzE2
MjM1OTU5WjBiMQswCQYDVQQGEwJaQTElMCMGA1UEChMcVGhhd3RlIENvbnN1bHRpbmcgKFB0eSkg
THRkLjEsMCoGA1UEAxMjVGhhd3RlIFBlcnNvbmFsIEZyZWVtYWlsIElzc3VpbmcgQ0EwgZ8wDQYJ
KoZIhvcNAQEBBQADgY0AMIGJAoGBAMSmPFVzVftOucqZWh5owHUEcJ3f6f+jHuy9zfVb8hp2vX8M
OmHyv1HOAdTlUAow1wJjWiyJFXCO3cnwK4Vaqj9xVsuvPAsH5/EfkTYkKhPPK9Xzgnc9A74r/rsY
Pge/QIACZNenprufZdHFKlSFD0gEf6e20TxhBEAeZBlyYLf7AgMBAAGjgZQwgZEwEgYDVR0TAQH/
BAgwBgEB/wIBADBDBgNVHR8EPDA6MDigNqA0hjJodHRwOi8vY3JsLnRoYXd0ZS5jb20vVGhhd3Rl
UGVyc29uYWxGcmVlbWFpbENBLmNybDALBgNVHQ8EBAMCAQYwKQYDVR0RBCIwIKQeMBwxGjAYBgNV
BAMTEVByaXZhdGVMYWJlbDItMTM4MA0GCSqGSIb3DQEBBQUAA4GBAEiM0VCD6gsuzA2jZqxnD3+v
rL7CF6FDlpSdf0whuPg2H6otnzYvwPQcUCCTcDz9reFhYsPZOhl+hLGZGwDFGguCdJ4lUJRix9sn
cVcljd2pnDmOjCBPZV+V2vf3h9bGCE6u9uo05RAaWzVNd+NWIXiC3CEZNd4ksdMdRv9dX2VPMYID
EDCCAwwCAQEwdjBiMQswCQYDVQQGEwJaQTElMCMGA1UEChMcVGhhd3RlIENvbnN1bHRpbmcgKFB0
eSkgTHRkLjEsMCoGA1UEAxMjVGhhd3RlIFBlcnNvbmFsIEZyZWVtYWlsIElzc3VpbmcgQ0ECEGM/
0V6419C0cZXhdH8bwIowCQYFKw4DAhoFAKCCAW8wGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAc
BgkqhkiG9w0BCQUxDxcNMDgwNzIzMTkwNTMxWjAjBgkqhkiG9w0BCQQxFgQUWtKHJnnliCFkCG03
0+oVDujvr3YwgYUGCSsGAQQBgjcQBDF4MHYwYjELMAkGA1UEBhMCWkExJTAjBgNVBAoTHFRoYXd0
ZSBDb25zdWx0aW5nIChQdHkpIEx0ZC4xLDAqBgNVBAMTI1RoYXd0ZSBQZXJzb25hbCBGcmVlbWFp
bCBJc3N1aW5nIENBAhBjP9FeuNfQtHGV4XR/G8CKMIGHBgsqhkiG9w0BCRACCzF4oHYwYjELMAkG
A1UEBhMCWkExJTAjBgNVBAoTHFRoYXd0ZSBDb25zdWx0aW5nIChQdHkpIEx0ZC4xLDAqBgNVBAMT
I1RoYXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBJc3N1aW5nIENBAhBjP9FeuNfQtHGV4XR/G8CKMA0G
CSqGSIb3DQEBAQUABIIBAFFHfoSi2lZQ8x7fTUGZowLR40FtAACf3AzCqotk2DPLgqL4xzUSl5l1
J7sVz4FuZbHW9dCXeRRHy+tqEzd+ZjfTEdMeDaSDzeS9GAcSueBfYOlA0QTjhPkxjCEBZFzkWfcX
ZUKoW5B1DaAr7afow3FLXiAgIouxbODpdY+MxULqCrE/ea5xM4931znqOr1ieUa2dJS1H7pS+N8z
A618wImbJwf7nZPQ/NCNP244oGdb9YmaQhX3pTpfwnyz07g2zJg85ZwA6ug3kbUTiOgGUlfoB10u
Evv7FsuIM9bfD0Mf+vqp8YVPhSn12KBtY68wgzdSZ2lA8cUb/2mkqRuCP7QAAAAAAAA=
--Apple-Mail-7-162045801--
