[Snort-users] IDS Load Balancer
gulfie at ...13618...
Mon Feb 27 03:07:04 EST 2006
On Sun, Feb 26, 2006 at 11:40:18PM -0800, Angel R wrote:
> Dear Bruce,
> We've several high performance servers in the data center that each of their bandwidth usage reachs about 300mbps. Our DataCenter connection to our users is several Gigbit Ethernet Links and we've no management on users network. So we've two place to setup our TAPs: the first place is near servers with about 300mbps and the other place is our connection to users network with about 400-500mbps each. On both of these places, a single IDS sensor can not handle the traffic so I need a Load Balancer like appliance that can balance the traffic to IDS sensors farm.
> Please note that I want to analyze all of the traffic and no filter can be applied on these traffics.
There are IDS load balancers. I have not used them, though a good googling may get you enough info.
There are other options. Multiple taps or spans with BPF filters, or ruleset tuning.
=> IDS configured for HTTP only traffic
=> IDS configured for NFS traffic
=> IDS configured for SMTP only traffic
=> IDS configured for other.
=> BPF for 10.10.12.0/24 (IDS)
=> BPF for 10.10.13.0/24 (IDS)
=> BPF for 10.10.14.0/24 (IDS)
The traffic replication can be done with spans or regeneration taps, the later being better. The
same sort of filtering can also be done with VACLs, and
Another option is to pass all the traffic through routes intentionaly segregating traffic by net block
, then add the taps there. Note, the routers'll need to be able to route on source address or use policy based routing.
Servers <--------> switch <---> Clients 10.10.12.0/24
|-> Clients 10.10.13.0/24
\-> Clients 10.10.14.0/24
Servers <--> Router Router <--> switch <---> Clients 10.10.12.0/24
|--> 10.10.12.0/24 bits <--| |-> Clients 10.10.13.0/24
|--> 10.10.13.0/24 bits <--| \-> Clients 10.10.14.0/24
\--> 10.10.14.0/24 bits <--/
Then tap between the two routers, or better yet, install an inline IPS which will automaticly rate limit traffic to the capacity that can be IDSed. As long as clients and servers are on different networks the clients need never know they are behind another set of routers / ipses. The traffic quantites can be to some extent adjusted via routing, or if you'd like through QOS on your two new routers.
So yes, it is possible to have multiple lower power/speed/whatever sensors watching a higher traffic link, however there are some nasty corner cases you'll have to watch out for.
1) Avg speed vs Bursting speed. A gige ethernet can stustain 2 gigabits /sec of traffic, even if the 5 minute average is only 100 Mbits/sec. Passive IDSes that don't do enough buffering will get flooded and blinded. Inline fixes that, but impacts users work by slowing the link down when it gets buisy. The same corner case shows up any where you can make an IDS slow. # connections /sec, flowtable entries, etc.
2) Depending on how traffic is segregated, you may loose detection. The simple exmaple is a rate based alarm. If the alarm trips at 12 events /sec, there are 20 eventes/sec and a single IDS, the alarm will go off. If there are 3 idses sharing the load, it may not go off. Or it may go off three times (bursting).
3) Flowbits don't work across IDSes.
> "Briggs, Bruce" <Bruce.Briggs at ...13183...> wrote: It would be helpful for you to tell us what you mean by a high traffic rate.
> Is it possible to have multiple Snort sensors at lower traffic rate locations in your network and still cover all traffic flows that you desire to monitor?
> From: snort-users-admin at lists.sourceforge.net [mailto:snort-users-admin at lists.sourceforge.net] On Behalf Of Angel R
> Sent: Sunday, February 26, 2006 7:35 AM
> To: snort-users at lists.sourceforge.net
> Subject: [Snort-users] IDS Load Balancer
> Dear All,
> I'm going to start a project to implement an end to end IDS solution in a data center. My problem is that high traffic rate in the data center leads me to use an load balancer to balance the traffic to multiple Snort servers. I'll be thankful if you help me to find a proper [including commercial] solution.
> Thanks all
> Yahoo! Mail
> Bring photos to life! New PhotoMail makes sharing a breeze.
> Yahoo! Mail
> Use Photomail to share photos without annoying attachments.
More information about the Snort-users