[120800] in North American Network Operators' Group
Re: D/DoS mitigation hardware/software needed.
daemon@ATHENA.MIT.EDU (Jeffrey Lyon)
Mon Jan 4 22:06:48 2010
In-Reply-To: <16720fe01001041905wab47d73xd5a6696ad4061ce7@mail.gmail.com>
Date: Mon, 4 Jan 2010 22:06:06 -0500
From: Jeffrey Lyon <jeffrey.lyon@blacklotus.net>
To: "Dobbins, Roland" <rdobbins@arbor.net>
Cc: NANOG list <nanog@nanog.org>
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
We have such a configuration in progress, it works great without any of the
issues you're proposing.
Jeff
On Jan 4, 2010 9:09 PM, "Dobbins, Roland" <rdobbins@arbor.net> wrote:
On Jan 5, 2010, at 4:25 AM, Jeffrey Lyon wrote: > Use a robust firewall such
as a Netscreen in fro...
Absolutely not - the firewall will fall over due to state-table exhaustion
before the mitigation system will. Firewalls (which have no place in front
of servers in the first place), load-balancers, and any other stateful
devices should be southbound of the mitigation system.
-----------------------------------------------------------------------
Roland Dobbins <rdobbins@arbor.net> // <http://www.arbornetworks.com>
Injustice is relatively easy to bear; what stings is justice.
-- H.L. Mencken
