Before Code Red, there was distributed denial of service. While distributed DoS attacks have not been the attack du jour as of late, they are still a strong threat to any network, providing the ability to cripple even the highest-bandwidth providers. Distributed DoS attacks are so threatening because they are difficult to identify.

Once identified, it is just as difficult to defend against them. Traffic filters are the best solution, but they must be manually implemented and they often also block legitimate network traffic. The distributed nature of the attack makes prevention virtually impossible because you never know where the next attack will come from.

Mazu Networks Inc.'s TrafficMaster Inspector helps solve some of these problems by providing a way to identify distributed DoS attacks in real time on large, high-speed networks.

While Inspector identifies distributed DoS attacks, it does not provide any assistance in filtering the identified attacks. (Mazu Networks' Enforcer gateway, due later this summer, will provide this capability.)

Inspector resides upstream at the core of the network infrastructure and passively observes all traffic entering or leaving the network. It can reside anywhere on the network, but works best near the first-level routers, where it can directly monitor traffic to and from the Internet.

Inspector connects to the data path via a passive optical or copper splitter, which introduces no latency into the network and performs detailed analysis in real time. Other distributed DoS solutions (from companies such as Asta Networks and Arbor Networks) receive a sample of network traffic from routers for analysis. Inspector sits directly on the network connection and monitors all traffic, independent of the network routers for packet information. One reason Mazu's solution is so expensive (US$100,000) is that the company had to develop a product that truly supported gigabit traffic levels.

Off to a good start

Overall, Mazu has a great start in developing a fast, efficient distributed DoS solution. Its approach to separate monitoring and defense mechanisms does not make Inspector an optimal solution on its own. If we have a tool that helps identify a distributed DoS attack, we'd also like that tool to at least recommend how to best defend against the current attack. We would probably wait until the Enforcer component becomes available (Mazu says Sept. 1) to provide a complete defense mechanism.

Analysis

Inspector examines packets on different metrics defined by the administrator and statistically determines whether an attack is occurring. These metrics can include, but are not limited to, packet size, source address, time to live (TTL) and payload.

For example, while attackers may spoof the source address on a packet, they cannot make changes to other aspects of the packet, such as payload. Inspector makes it difficult for an attacker to launch a surge of network traffic without introducing an anomaly that it is able to detect. This includes unusual variations or lack of variation in payload, port numbers, TTL and other metrics.

Inspector has two main components: the probe and the cluster head. Probes are individual sensors that can be distributed throughout a network to capture and

• Email
• Print
• Share
  • Slashdot
  • Digg
  • Stumble
  • Reddit
  • Newsvine