|
> Days before, I setup an IDS on the lvs director, and I had a simple test on
> the director by connectting the mean-service-time, HitRatio .. which cost me
> dual weeks. And I found that snort does not affect the performance.
Depends on the configuration, it's actually quiet easy to kill Snort
with some advanced ruleset and above L4 checks.
> as both
> snort and iptables use libpcap library to scratch packets,
iptables does not use libpcap, to my avail, so I'm not sure I understand
your question.
> does it mean the
> iptables will not affect the director's performance ? or am I right before
> when using snort?
iptables is the user space part of netfilter, which is in the kernel. So
no, iptables will not hurt performance, but netfilter certainly does,
depending on the usage, amount of rules and your hardware configuration.
> I 'm mastering several highly loaded LVSs, these days I found that there are
> so many maliciouswe scans so I want to ban them all by portsentry. And we
> also confused by by ddos :-/
Portsentry only mitigates the problem, doesn't solve it. Also, it's not
something that should be implemented on the LVS. Also having a NIDS on
the director is a bit suboptimal, since a IDS should at best not be
detectable and should also be in read-only mode. Either put a second box
between the networks you need to sniff, preferrably in bridge mode or
modify your network cables by removing the TX part, so only receiving is
possible. Both suggestions don't work well with a director.
Regards,
Roberto Nibali, ratz
--
-------------------------------------------------------------
addr://Kasinostrasse 30, CH-5001 Aarau tel://++41 62 823 9355
http://www.terreactive.com fax://++41 62 823 9356
-------------------------------------------------------------
terreActive AG Wir sichern Ihren Erfolg
-------------------------------------------------------------
|
