[Snort-users] IDS Load Balancer

Gulfie gulfie at ...13618...
Mon Feb 27 03:07:04 EST 2006


On Sun, Feb 26, 2006 at 11:40:18PM -0800, Angel R wrote:
> Dear Bruce,
> 
>     We've several high performance servers in the data center that each of their bandwidth usage reachs about 300mbps. Our DataCenter connection to our users is several Gigbit Ethernet Links and we've no management on users network. So we've two place to setup our TAPs: the first place is near servers with about 300mbps and the other place is our connection to users network with about 400-500mbps each. On both of these places, a single IDS sensor can not handle the traffic so I need a Load Balancer like appliance that can balance the traffic to IDS sensors farm.
> 
>    Please note that I want to analyze all of the traffic and no filter can be applied on these traffics.



	There are IDS load balancers.  I have not used them, though a good googling may get you enough info.

	There are other options.  Multiple taps or spans with BPF filters, or ruleset tuning. 

		<source>  
			  =>	IDS configured for HTTP only traffic
			  =>    IDS configured for NFS traffic 
  			  =>    IDS configured for SMTP only traffic
			  =>    IDS configured for other. 
			or
		<source>  
			  =>    BPF for 10.10.12.0/24  (IDS) 
			  =>    BPF for 10.10.13.0/24  (IDS)
			  =>    BPF for 10.10.14.0/24  (IDS)

	The traffic replication can be done with spans or regeneration taps, the later being better.  The 
same sort of filtering can also be done with VACLs, and  

	Another option is to pass all the traffic through routes intentionaly segregating traffic by net block
, then add the taps there.   Note, the routers'll need to be able to route on source address or use policy based routing.

		Before :

		Servers    <-------->    switch  <---> Clients  10.10.12.0/24
						   |-> Clients  10.10.13.0/24
						   \-> Clients  10.10.14.0/24
							
	
		After : 

		Servers    <-->  Router                         Router  <-->  switch    <---> Clients  10.10.12.0/24
				    |-->  10.10.12.0/24 bits  <--|			   |-> Clients  10.10.13.0/24
				    |-->  10.10.13.0/24 bits  <--|			   \-> Clients  10.10.14.0/24
				    \-->  10.10.14.0/24 bits  <--/			   


		Then tap between the two routers, or better yet, install an inline IPS which will automaticly rate limit traffic to the capacity that can be IDSed.  As long as clients and servers are on different networks the clients need never know they are behind another set of routers / ipses.  The traffic quantites can be to some extent adjusted via routing, or if you'd like through QOS on your two new routers.  
					

	So yes, it is possible to have multiple lower power/speed/whatever sensors watching a higher traffic link, however there are some nasty corner cases you'll have to watch out for. 

	1) Avg speed vs Bursting speed.  A gige ethernet can stustain 2 gigabits /sec of traffic, even if the 5 minute average is only 100 Mbits/sec.  Passive IDSes that don't do enough buffering will get flooded and blinded.  Inline fixes that, but impacts users work by slowing the link down when it gets buisy.   The same corner case shows up any where you can make an IDS slow. # connections /sec, flowtable entries, etc. 

	2) Depending on how traffic is segregated, you may loose detection.  The simple exmaple is a rate based alarm.  If the alarm trips at 12 events /sec, there are 20 eventes/sec and a single IDS, the alarm will go off.  If there are 3 idses sharing the load, it may not go off.  Or it may go off three times (bursting). 

	3) Flowbits don't work across IDSes.





								Good luck. 
								-gulfie
 
> Thanks
> 
> "Briggs, Bruce" <Bruce.Briggs at ...13183...> wrote:     It would be helpful for you to tell us what you mean by  a high traffic rate.
>  Is it possible to have multiple Snort sensors at lower  traffic rate locations in your network and still cover all traffic flows that  you desire to monitor?
>   
>  Bruce
> 
>   
> ---------------------------------
>  From: snort-users-admin at lists.sourceforge.net  [mailto:snort-users-admin at lists.sourceforge.net] On Behalf Of Angel  R
> Sent: Sunday, February 26, 2006 7:35 AM
> To:  snort-users at lists.sourceforge.net
> Subject: [Snort-users] IDS Load  Balancer
> 
> 
>  
> Dear All,
> 
>      I'm going to start a  project to implement an end to end IDS solution in a data center. My problem is  that high traffic rate in the data center leads me to use an load balancer to  balance the traffic to multiple Snort servers. I'll be thankful if you help me  to find a proper [including commercial] solution.
> 
> Thanks all
>   
> 
> ---------------------------------
>  Yahoo! Mail
> Bring photos to life! New  PhotoMail makes sharing a breeze. 
> 
> 		
> ---------------------------------
>  Yahoo! Mail
>  Use Photomail to share photos without annoying attachments.




More information about the Snort-users mailing list