[120793] in North American Network Operators' Group
Re: D/DoS mitigation hardware/software needed.
daemon@ATHENA.MIT.EDU (Dobbins, Roland)
Mon Jan 4 21:07:57 2010
From: "Dobbins, Roland" <rdobbins@arbor.net>
To: NANOG list <nanog@nanog.org>
Date: Tue, 5 Jan 2010 02:04:44 +0000
In-Reply-To: <16720fe01001041325k55f913ddw56dfd00274cc19f9@mail.gmail.com>
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
On Jan 5, 2010, at 4:25 AM, Jeffrey Lyon wrote:
> Use a robust firewall such as a Netscreen in front of your mitigation
> tool.
Absolutely not - the firewall will fall over due to state-table exhaustion =
before the mitigation system will. Firewalls (which have no place in front=
of servers in the first place), load-balancers, and any other stateful dev=
ices should be southbound of the mitigation system.
-----------------------------------------------------------------------
Roland Dobbins <rdobbins@arbor.net> // <http://www.arbornetworks.com>
Injustice is relatively easy to bear; what stings is justice.
-- H.L. Mencken
