Re: L7 packet inspection
S. Stefán Sigurðsson <[email protected]> Thu, 28 Jan 2010 10:52:56 +0000
| Newsgroups | gmane.comp.programming.load-balancing.general |
|---|---|
| Message-ID | <[email protected]> |
--===============0266531833== Content-Language: en-US Content-Type: multipart/alternative; boundary="_000_1CAE1A202F8A6243BF42C9649CAACCE407945E99DFexchisccpadlo_" --_000_1CAE1A202F8A6243BF42C9649CAACCE407945E99DFexchisccpadlo_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable We are running MMO you may have heard of www.eveonline.com<http://www.eveon= line.com>, now our servers are spending a allot of power investigating/auth= enticating traffic to make sure users are not modifying their clients, tryi= ng sending inject their own commands or trying to hack account. We are loo= king into handing some of that work over to the SLB or the network in front= . Currently we are just trying to see what options we have and we don't hav= e any defined needs, we may even reprogram some of our code to fit the L7 c= apabilities. Only thing I can say for sure is that any increase in latenc= y is really bad for us. From: [email protected] [mailto:[email protected]] On Behalf Of K= enneth Salchow Sent: 27. jan=FAar 2010 20:35 To: Load Balancing Mailing List Subject: Re: [load balancing] L7 packet inspection Sorry for delayed response-was having too much fun in Europe. :) Par usual, Ed, Tony and (increasingly) Surya have covered a lot of the base= s here-what they didn't specifically call out, but intimated, is that you r= eally didn't specify *what* you want to do at L7. That's a HUGE determinat= ion in what you look for and who you but it from. The products, prices and= capabilities range quite widely-heck, even here at F5 we have several diff= erent capabilities from the basic L7 capability in the ADC, to a protocol e= nforcement product to a full-fledged application firewall. Which solution = makes the most sense totally depends on what you want to do. Instead of just throwing out various products and vendors generically-can y= ou narrow down your goals a little? Thanks, KJ (Ken) Salchow, Jr. | Manager, Technical Marketing D 651.423.1133 M 612.868.1258 P 206.272.5555 F 206.272.5555 www.f5.com<http://www.f5.com/> From: [email protected] [mailto:[email protected]] On Behalf Of S= . Stef=E1n Sigur=F0sson Sent: Friday, January 22, 2010 5:28 AM To: [email protected] Subject: [load balancing] L7 packet inspection Hi, my company wants to start doing packet L7 inspection on all traffic goi= ng through the load balancer. Now my concern (cost aside) is how will I get the best performance possible= , ever ms counts. We are currently using an Ace module to do our SLB and it has the option o= f L7 inspect but will that perform any better than putting a good L7 firewa= ll in front of the ACE. We are still just in the concept stage of this plan so any advice or good i= dea would be greatly appreciated.. S. Stefan --_000_1CAE1A202F8A6243BF42C9649CAACCE407945E99DFexchisccpadlo_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable <META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; charset=3Diso-8859-= 1"> <html xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-micr= osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" = xmlns:x=3D"urn:schemas-microsoft-com:office:excel" xmlns:p=3D"urn:schemas-m= icrosoft-com:office:powerpoint" xmlns:a=3D"urn:schemas-microsoft-com:office= :access" xmlns:dt=3D"uuid:C2F41010-65B3-11d1-A29F-00AA00C14882" xmlns:s=3D"= uuid:BDC6E3F0-6DA3-11d1-A2A3-00AA00C14882" xmlns:rs=3D"urn:schemas-microsof= t-com:rowset" xmlns:z=3D"#RowsetSchema" xmlns:b=3D"urn:schemas-microsoft-co= m:office:publisher" xmlns:ss=3D"urn:schemas-microsoft-com:office:spreadshee= t" xmlns:c=3D"urn:schemas-microsoft-com:office:component:spreadsheet" xmlns= :odc=3D"urn:schemas-microsoft-com:office:odc" xmlns:oa=3D"urn:schemas-micro= soft-com:office:activation" xmlns:html=3D"http://www.w3.org/TR/REC-html40" = xmlns:q=3D"http://schemas.xmlsoap.org/soap/envelope/" xmlns:rtc=3D"http://m= icrosoft.com/officenet/conferencing" xmlns:D=3D"DAV:" xmlns:Repl=3D"http://= schemas.microsoft.com/repl/" xmlns:mt=3D"http://schemas.microsoft.com/share= point/soap/meetings/" xmlns:x2=3D"http://schemas.microsoft.com/office/excel= /2003/xml" xmlns:ppda=3D"http://www.passport.com/NameSpace.xsd" xmlns:ois= =3D"http://schemas.microsoft.com/sharepoint/soap/ois/" xmlns:dir=3D"http://= schemas.microsoft.com/sharepoint/soap/directory/" xmlns:ds=3D"http://www.w3= .org/2000/09/xmldsig#" xmlns:dsp=3D"http://schemas.microsoft.com/sharepoint= /dsp" xmlns:udc=3D"http://schemas.microsoft.com/data/udc" xmlns:xsd=3D"http= ://www.w3.org/2001/XMLSchema" xmlns:sub=3D"http://schemas.microsoft.com/sha= repoint/soap/2002/1/alerts/" xmlns:ec=3D"http://www.w3.org/2001/04/xmlenc#"= xmlns:sp=3D"http://schemas.microsoft.com/sharepoint/" xmlns:sps=3D"http://= schemas.microsoft.com/sharepoint/soap/" xmlns:xsi=3D"http://www.w3.org/2001= /XMLSchema-instance" xmlns:udcs=3D"http://schemas.microsoft.com/data/udc/so= ap" xmlns:udcxf=3D"http://schemas.microsoft.com/data/udc/xmlfile" xmlns:udc= p2p=3D"http://schemas.microsoft.com/data/udc/parttopart" xmlns:wf=3D"http:/= /schemas.microsoft.com/sharepoint/soap/workflow/" xmlns:dsss=3D"http://sche= mas.microsoft.com/office/2006/digsig-setup" xmlns:dssi=3D"http://schemas.mi= crosoft.com/office/2006/digsig" xmlns:mdssi=3D"http://schemas.openxmlformat= s.org/package/2006/digital-signature" xmlns:mver=3D"http://schemas.openxmlf= ormats.org/markup-compatibility/2006" xmlns:m=3D"http://schemas.microsoft.c= om/office/2004/12/omml" xmlns:mrels=3D"http://schemas.openxmlformats.org/pa= ckage/2006/relationships" xmlns:spwp=3D"http://microsoft.com/sharepoint/web= partpages" xmlns:ex12t=3D"http://schemas.microsoft.com/exchange/services/20= 06/types" xmlns:ex12m=3D"http://schemas.microsoft.com/exchange/services/200= 6/messages" xmlns:pptsl=3D"http://schemas.microsoft.com/sharepoint/soap/Sli= deLibrary/" xmlns:spsl=3D"http://microsoft.com/webservices/SharePointPortal= Server/PublishedLinksService" xmlns:Z=3D"urn:schemas-microsoft-com:" xmlns:= st=3D"" xmlns=3D"http://www.w3.org/TR/REC-html40"> <head> <meta name=3DGenerator content=3D"Microsoft Word 12 (filtered medium)"> <style> <!-- /* Font Definitions */ @font-face {font-family:Wingdings; panose-1:5 0 0 0 0 0 0 0 0 0;} @font-face {font-family:"Cambria Math"; panose-1:2 4 5 3 5 4 6 3 2 4;} @font-face {font-family:Calibri; panose-1:2 15 5 2 2 2 4 3 2 4;} @font-face {font-family:Tahoma; panose-1:2 11 6 4 3 5 4 4 2 4;} /* Style Definitions */ p.MsoNormal, li.MsoNormal, div.MsoNormal {margin:0cm; margin-bottom:.0001pt; font-size:11.0pt; font-family:"Calibri","sans-serif";} a:link, span.MsoHyperlink {mso-style-priority:99; color:blue; text-decoration:underline;} a:visited, span.MsoHyperlinkFollowed {mso-style-priority:99; color:purple; text-decoration:underline;} span.EmailStyle17 {mso-style-type:personal; font-family:"Calibri","sans-serif"; color:windowtext;} span.EmailStyle18 {mso-style-type:personal; font-family:"Calibri","sans-serif"; color:#1F497D;} span.EmailStyle19 {mso-style-type:personal; font-family:"Calibri","sans-serif"; color:#1F497D;} span.EmailStyle20 {mso-style-type:personal-reply; font-family:"Calibri","sans-serif"; color:#1F497D;} .MsoChpDefault {mso-style-type:export-only; font-size:10.0pt;} @page Section1 {size:612.0pt 792.0pt; margin:70.85pt 70.85pt 70.85pt 70.85pt;} div.Section1 {page:Section1;} --> </style> <!--[if gte mso 9]><xml> <o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" /> </xml><![endif]--><!--[if gte mso 9]><xml> <o:shapelayout v:ext=3D"edit"> <o:idmap v:ext=3D"edit" data=3D"1" /> </o:shapelayout></xml><![endif]--> </head> <body lang=3DIS link=3Dblue vlink=3Dpurple> <div class=3DSection1> <p class=3DMsoNormal><span lang=3DEN-US style=3D'color:#1F497D'>We are runn= ing MMO you may have heard of <a href=3D"http://www.eveonline.com">www.eveonline.co= m</a>, now our servers are spending a allot of power investigating/authenticating traffic to make sure users are not modifying their clients, trying sending = inject their own commands or trying to hack account.=A0 We are looking into handin= g some of that work over to the SLB or the network in front. Currently we are just trying to see what options we have and we don’t have any defined need= s, we may even reprogram some of our code to fit the L7 capabilities. =A0=A0Only thin= g I can say for sure is that any increase in latency is really bad for us.<o:p></o:= p></span></p> <p class=3DMsoNormal><span style=3D'color:#1F497D'><o:p> </o:p></span>= </p> <p class=3DMsoNormal><span style=3D'color:#1F497D'><o:p> </o:p></span>= </p> <p class=3DMsoNormal><span style=3D'color:#1F497D'><o:p> </o:p></span>= </p> <p class=3DMsoNormal><span style=3D'color:#1F497D'><o:p> </o:p></span>= </p> <p class=3DMsoNormal><span style=3D'color:#1F497D'><o:p> </o:p></span>= </p> <p class=3DMsoNormal><span style=3D'color:#1F497D'><o:p> </o:p></span>= </p> <div> <div style=3D'border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm = 0cm 0cm'> <p class=3DMsoNormal><b><span lang=3DEN-US style=3D'font-size:10.0pt;font-f= amily: "Tahoma","sans-serif"'>From:</span></b><span lang=3DEN-US style=3D'font-siz= e:10.0pt; font-family:"Tahoma","sans-serif"'> [email protected] [mailto:[email protected]] <b>On Behalf Of </b>Kenneth Salchow<br> <b>Sent:</b> 27. jan=FAar 2010 20:35<br> <b>To:</b> Load Balancing Mailing List<br> <b>Subject:</b> Re: [load balancing] L7 packet inspection<o:p></o:p></span>= </p> </div> </div> <p class=3DMsoNormal><o:p> </o:p></p> <p class=3DMsoNormal><span lang=3DEN-US style=3D'color:#1F497D'>Sorry for d= elayed response—was having too much fun in Europe. </span><span lang= =3DEN-US style=3D'font-family:Wingdings;color:#1F497D'>J</span><span lang=3DEN-US style=3D'color:#1F497D'><o:p></o:p></span></p> <p class=3DMsoNormal><span lang=3DEN-US style=3D'color:#1F497D'><o:p> = </o:p></span></p> <p class=3DMsoNormal><span lang=3DEN-US style=3D'color:#1F497D'>Par usual, = Ed, Tony and (increasingly) Surya have covered a lot of the bases here—what th= ey didn’t specifically call out, but intimated, is that you really didn’t speci= fy *<b>what</b>* you want to do at L7. That’s a HUGE determination in what you l= ook for and who you but it from. The products, prices and capabilities range quite widely—heck, even here at F5 we have several different capabili= ties from the basic L7 capability in the ADC, to a protocol enforcement product to a full-fledged application firewall. Which solution makes the most sens= e totally depends on what you want to do.<o:p></o:p></span></p> <p class=3DMsoNormal><span lang=3DEN-US style=3D'color:#1F497D'><o:p> = </o:p></span></p> <p class=3DMsoNormal><span lang=3DEN-US style=3D'color:#1F497D'>Instead of = just throwing out various products and vendors generically—can you narrow = down your goals a little? <o:p></o:p></span></p> <p class=3DMsoNormal><span lang=3DEN-US style=3D'color:#1F497D'><o:p> = </o:p></span></p> <p class=3DMsoNormal><span lang=3DEN-US style=3D'color:#1F497D'>Thanks,<o:p= ></o:p></span></p> <p class=3DMsoNormal><span lang=3DEN-US style=3D'color:#1F497D'><o:p> = </o:p></span></p> <div> <table class=3DMsoNormalTable border=3D0 cellpadding=3D0 width=3D425 style= =3D'width:318.75pt'> <tr> <td colspan=3D5 style=3D'padding:.75pt .75pt .75pt .75pt'> <p class=3DMsoNormal><b><span style=3D'font-size:10.0pt;font-family:"Aria= l","sans-serif"; color:#1F497D'>KJ (Ken) Salchow, Jr.</span></b><span style=3D'font-size:1= 0.0pt; font-family:"Arial","sans-serif";color:#1F497D'> | Manager, Technical Marketing</span><span style=3D'font-size:12.0pt;color:#1F497D'><o:p></o:p= ></span></p> </td> </tr> <tr style=3D'height:9.0pt'> <td width=3D84 style=3D'width:63.0pt;padding:.75pt .75pt .75pt .75pt;heig= ht:9.0pt'> <p class=3DMsoNormal style=3D'mso-margin-top-alt:auto;mso-margin-bottom-a= lt:auto; line-height:9.0pt'><b><span style=3D'font-size:7.5pt;font-family:"Arial",= "sans-serif"; color:#333333'>D 651.423.1133</span></b><span style=3D'font-size:12.0pt; font-family:"Times New Roman","serif";color:#1F497D'><o:p></o:p></span></= p> </td> <td width=3D84 style=3D'width:63.0pt;padding:.75pt .75pt .75pt .75pt;heig= ht:9.0pt'> <p class=3DMsoNormal style=3D'line-height:9.0pt'><b><span style=3D'font-s= ize:7.5pt; font-family:"Arial","sans-serif";color:#333333'>M 612.868.1258</span></b>= <span style=3D'font-size:12.0pt;color:#1F497D'><o:p></o:p></span></p> </td> <td width=3D84 style=3D'width:63.0pt;padding:.75pt .75pt .75pt .75pt;heig= ht:9.0pt'> <p class=3DMsoNormal style=3D'line-height:9.0pt'><b><span style=3D'font-s= ize:7.5pt; font-family:"Arial","sans-serif";color:#333333'>P 206.272.5555</span></b>= <span style=3D'font-size:12.0pt;color:#1F497D'><o:p></o:p></span></p> </td> <td width=3D84 style=3D'width:63.0pt;padding:.75pt .75pt .75pt .75pt;heig= ht:9.0pt'> <p class=3DMsoNormal style=3D'line-height:9.0pt'><b><span style=3D'font-s= ize:7.5pt; font-family:"Arial","sans-serif";color:#333333'>F 206.272.5555</span></b>= <span style=3D'font-size:12.0pt;color:#1F497D'><o:p></o:p></span></p> </td> <td width=3D69 style=3D'width:51.75pt;padding:.75pt .75pt .75pt .75pt;hei= ght: 9.0pt'> <p class=3DMsoNormal style=3D'line-height:9.0pt'><b><span style=3D'font-s= ize:7.5pt; font-family:"Arial","sans-serif";color:#333333'><a href=3D"http://www.f5.= com/"><span style=3D'color:#333333'>www.f5.com</span></a></span></b><span style=3D'fo= nt-size: 12.0pt;color:#1F497D'><o:p></o:p></span></p> </td> </tr> </table> <p class=3DMsoNormal><span lang=3DEN-US style=3D'color:#1F497D'><o:p> = </o:p></span></p> <p class=3DMsoNormal><span lang=3DEN-US style=3D'color:#1F497D'><o:p> = </o:p></span></p> <div> <div style=3D'border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm = 0cm 0cm'> <p class=3DMsoNormal style=3D'margin-left:36.0pt'><b><span lang=3DEN-US style=3D'font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></= b><span lang=3DEN-US style=3D'font-size:10.0pt;font-family:"Tahoma","sans-serif"'> [email protected] [mailto:[email protected]] <b>On Behalf Of </b>= S. Stef=E1n Sigur=F0sson<br> <b>Sent:</b> Friday, January 22, 2010 5:28 AM<br> <b>To:</b> [email protected]<br> <b>Subject:</b> [load balancing] L7 packet inspection<o:p></o:p></span></p> </div> </div> <p class=3DMsoNormal style=3D'margin-left:36.0pt'><span lang=3DEN-US><o:p>&= nbsp;</o:p></span></p> <p class=3DMsoNormal style=3D'margin-left:36.0pt'><span lang=3DEN-US>Hi, my= company wants to start doing packet L7 inspection on all traffic going through the = load balancer.<o:p></o:p></span></p> <p class=3DMsoNormal style=3D'margin-left:36.0pt'><span lang=3DEN-US><o:p>&= nbsp;</o:p></span></p> <p class=3DMsoNormal style=3D'margin-left:36.0pt'><span lang=3DEN-US>Now <s= pan style=3D'color:#1F497D'>m</span>y concern (cost aside) is how will I get th= e best performance possible, ever ms counts.<o:p></o:p></span></p> <p class=3DMsoNormal style=3D'margin-left:36.0pt'><span lang=3DEN-US><o:p>&= nbsp;</o:p></span></p> <p class=3DMsoNormal style=3D'margin-left:36.0pt'><span lang=3DEN-US>We are= currently using an Ace module to do our SLB and it has the option of L7 inspect= but will that perform any better than putting a good L7 firewall in front of th= e ACE.<o:p></o:p></span></p> <p class=3DMsoNormal style=3D'margin-left:36.0pt'><span lang=3DEN-US><o:p>&= nbsp;</o:p></span></p> <p class=3DMsoNormal style=3D'margin-left:36.0pt'><span lang=3DEN-US>We are= still just in the concept stage of this plan so any advice or good idea would be greatly appreciated..<o:p></o:p></span></p> <p class=3DMsoNormal style=3D'margin-left:36.0pt'><o:p> </o:p></p> <p class=3DMsoNormal style=3D'margin-left:36.0pt'>S. Stefan <o:p></o:p></p> </div> </div> </body> </html> --_000_1CAE1A202F8A6243BF42C9649CAACCE407945E99DFexchisccpadlo_-- --===============0266531833== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ lb-l mailing list [email protected] http://vegan.net/mailman/listinfo/lb-l Searchable Archive: http://vegan.net/lb/archive http://lbdigest.com Load Balancing Digest http://lbwiki.com Load Balancing Wiki --===============0266531833==--