Re: L7 packet inspection
Kevin Cullimore <[email protected]> Thu, 28 Jan 2010 11:54:29 -0500
| Newsgroups | gmane.comp.programming.load-balancing.general |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format. --===============0223053767== Content-Type: multipart/alternative; boundary="------------060308020702060003010101" This is a multi-part message in MIME format. --------------060308020702060003010101 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: quoted-printable X-MIME-Autoconverted: from 8bit to quoted-printable by soda.vegan.net id o0SGsgp9031382 If you're willing to handle L7 via the "network in front," the best=20 performance I've encountered recently was delivered courtesy of the=20 following product line: http://www.paloaltonetworks.com/products/pa4000.html On 1/28/2010 5:52 AM, S. Stef=E1n Sigur=F0sson wrote: > > We are running MMO you may have heard of www.eveonline.com=20 > <http://www.eveonline.com>, now our servers are spending a allot of=20 > power investigating/authenticating traffic to make sure users are not=20 > modifying their clients, trying sending inject their own commands or=20 > trying to hack account. We are looking into handing some of that work=20 > over to the SLB or the network in front. Currently we are just trying=20 > to see what options we have and we don't have any defined needs, we=20 > may even reprogram some of our code to fit the L7 capabilities. Only=20 > thing I can say for sure is that any increase in latency is really bad=20 > for us. > > *From:* [email protected] [mailto:[email protected]] *On=20 > Behalf Of *Kenneth Salchow > *Sent:* 27. jan=FAar 2010 20:35 > *To:* Load Balancing Mailing List > *Subject:* Re: [load balancing] L7 packet inspection > > Sorry for delayed response---was having too much fun in Europe. J > > Par usual, Ed, Tony and (increasingly) Surya have covered a lot of the=20 > bases here---what they didn't specifically call out, but intimated, is=20 > that you really didn't specify **what** you want to do at L7. That's=20 > a HUGE determination in what you look for and who you but it from. =20 > The products, prices and capabilities range quite widely---heck, even=20 > here at F5 we have several different capabilities from the basic L7=20 > capability in the ADC, to a protocol enforcement product to a=20 > full-fledged application firewall. Which solution makes the most=20 > sense totally depends on what you want to do. > > Instead of just throwing out various products and vendors=20 > generically---can you narrow down your goals a little? > > Thanks, > > *KJ (Ken) Salchow, Jr.* | Manager, Technical Marketing > > *D 651.423.1133* > > =09 > > *M 612.868.1258* > > =09 > > *P 206.272.5555* > > =09 > > *F 206.272.5555* > > =09 > > *www.f5.com <http://www.f5.com/>* > > *From:* [email protected] [mailto:[email protected]] *On=20 > Behalf Of *S. Stef=E1n Sigur=F0sson > *Sent:* Friday, January 22, 2010 5:28 AM > *To:* [email protected] > *Subject:* [load balancing] L7 packet inspection > > Hi, my company wants to start doing packet L7 inspection on all=20 > traffic going through the load balancer. > > Now my concern (cost aside) is how will I get the best performance=20 > possible, ever ms counts. > > We are currently using an Ace module to do our SLB and it has the=20 > option of L7 inspect but will that perform any better than putting a=20 > good L7 firewall in front of the ACE. > > We are still just in the concept stage of this plan so any advice or=20 > good idea would be greatly appreciated.. > > S. Stefan > > > _______________________________________________ > lb-l mailing list > [email protected] > http://vegan.net/mailman/listinfo/lb-l > Searchable Archive: http://vegan.net/lb/archive > http://lbdigest.com Load Balancing Digest > http://lbwiki.com Load Balancing Wiki > =20 --------------060308020702060003010101 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type"> </head> <body bgcolor="#ffffff" text="#000000"> If you're willing to handle L7 via the "network in front," the best performance I've encountered recently was delivered courtesy of the following product line:<br> <br> <a class="moz-txt-link-freetext" href="http://www.paloaltonetworks.com/products/pa4000.html">http://www.paloaltonetworks.com/products/pa4000.html</a><br> <br> <br> On 1/28/2010 5:52 AM, S. Stefán Sigurðsson wrote: <blockquote cite="mid:[email protected]" type="cite"> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> <meta name="Generator" content="Microsoft Word 12 (filtered medium)"> <style> <!-- /* Font Definitions */ @font-face {font-family:Wingdings; panose-1:5 0 0 0 0 0 0 0 0 0;} @font-face {font-family:"Cambria Math"; panose-1:2 4 5 3 5 4 6 3 2 4;} @font-face {font-family:Calibri; panose-1:2 15 5 2 2 2 4 3 2 4;} @font-face {font-family:Tahoma; panose-1:2 11 6 4 3 5 4 4 2 4;} /* Style Definitions */ p.MsoNormal, li.MsoNormal, div.MsoNormal {margin:0cm; margin-bottom:.0001pt; font-size:11.0pt; font-family:"Calibri","sans-serif";} a:link, span.MsoHyperlink {mso-style-priority:99; color:blue; text-decoration:underline;} a:visited, span.MsoHyperlinkFollowed {mso-style-priority:99; color:purple; text-decoration:underline;} span.EmailStyle17 {mso-style-type:personal; font-family:"Calibri","sans-serif"; color:windowtext;} span.EmailStyle18 {mso-style-type:personal; font-family:"Calibri","sans-serif"; color:#1F497D;} span.EmailStyle19 {mso-style-type:personal; font-family:"Calibri","sans-serif"; color:#1F497D;} span.EmailStyle20 {mso-style-type:personal-reply; font-family:"Calibri","sans-serif"; color:#1F497D;} .MsoChpDefault {mso-style-type:export-only; font-size:10.0pt;} @page Section1 {size:612.0pt 792.0pt; margin:70.85pt 70.85pt 70.85pt 70.85pt;} div.Section1 {page:Section1;} --> </style> <!--[if gte mso 9]><xml> <o:shapedefaults v:ext="edit" spidmax="1026" /> </xml><![endif]--><!--[if gte mso 9]><xml> <o:shapelayout v:ext="edit"> <o:idmap v:ext="edit" data="1" /> </o:shapelayout></xml><![endif]--> <div class="Section1"> <p class="MsoNormal"><span style="color: rgb(31, 73, 125);" lang="EN-US">We are running MMO you may have heard of <a moz-do-not-send="true" href="http://www.eveonline.com">www.eveonline.com</a>, now our servers are spending a allot of power investigating/authenticating traffic to make sure users are not modifying their clients, trying sending inject their own commands or trying to hack account. We are looking into handing some of that work over to the SLB or the network in front. Currently we are just trying to see what options we have and we don’t have any defined needs, we may even reprogram some of our code to fit the L7 capabilities. Only thing I can say for sure is that any increase in latency is really bad for us.<o:p></o:p></span></p> <p class="MsoNormal"><span style="color: rgb(31, 73, 125);"><o:p> </o:p></span></p> <p class="MsoNormal"><span style="color: rgb(31, 73, 125);"><o:p> </o:p></span></p> <p class="MsoNormal"><span style="color: rgb(31, 73, 125);"><o:p> </o:p></span></p> <p class="MsoNormal"><span style="color: rgb(31, 73, 125);"><o:p> </o:p></span></p> <p class="MsoNormal"><span style="color: rgb(31, 73, 125);"><o:p> </o:p></span></p> <p class="MsoNormal"><span style="color: rgb(31, 73, 125);"><o:p> </o:p></span></p> <div> <div style="border-style: solid none none; border-color: rgb(181, 196, 223) -moz-use-text-color -moz-use-text-color; border-width: 1pt medium medium; padding: 3pt 0cm 0cm;"> <p class="MsoNormal"><b><span style="font-size: 10pt; font-family: "Tahoma","sans-serif";" lang="EN-US">From:</span></b><span style="font-size: 10pt; font-family: "Tahoma","sans-serif";" lang="EN-US"> <a class="moz-txt-link-abbreviated" href="mailto:[email protected]">[email protected]</a> [<a class="moz-txt-link-freetext" href="mailto:[email protected]">mailto:[email protected]</a>] <b>On Behalf Of </b>Kenneth Salchow<br> <b>Sent:</b> 27. janúar 2010 20:35<br> <b>To:</b> Load Balancing Mailing List<br> <b>Subject:</b> Re: [load balancing] L7 packet inspection<o:p></o:p></span></p> </div> </div> <p class="MsoNormal"><o:p> </o:p></p> <p class="MsoNormal"><span style="color: rgb(31, 73, 125);" lang="EN-US">Sorry for delayed response—was having too much fun in Europe. </span><span style="font-family: Wingdings; color: rgb(31, 73, 125);" lang="EN-US">J</span><span style="color: rgb(31, 73, 125);" lang="EN-US"><o:p></o:p></span></p> <p class="MsoNormal"><span style="color: rgb(31, 73, 125);" lang="EN-US"><o:p> </o:p></span></p> <p class="MsoNormal"><span style="color: rgb(31, 73, 125);" lang="EN-US">Par usual, Ed, Tony and (increasingly) Surya have covered a lot of the bases here—what they didn’t specifically call out, but intimated, is that you really didn’t specify *<b>what</b>* you want to do at L7. That’s a HUGE determination in what you look for and who you but it from. The products, prices and capabilities range quite widely—heck, even here at F5 we have several different capabilities from the basic L7 capability in the ADC, to a protocol enforcement product to a full-fledged application firewall. Which solution makes the most sense totally depends on what you want to do.<o:p></o:p></span></p> <p class="MsoNormal"><span style="color: rgb(31, 73, 125);" lang="EN-US"><o:p> </o:p></span></p> <p class="MsoNormal"><span style="color: rgb(31, 73, 125);" lang="EN-US">Instead of just throwing out various products and vendors generically—can you narrow down your goals a little? <o:p></o:p></span></p> <p class="MsoNormal"><span style="color: rgb(31, 73, 125);" lang="EN-US"><o:p> </o:p></span></p> <p class="MsoNormal"><span style="color: rgb(31, 73, 125);" lang="EN-US">Thanks,<o:p></o:p></span></p> <p class="MsoNormal"><span style="color: rgb(31, 73, 125);" lang="EN-US"><o:p> </o:p></span></p> <div> <table class="MsoNormalTable" style="width: 318.75pt;" width="425" border="0" cellpadding="0"> <tbody> <tr> <td colspan="5" style="padding: 0.75pt;"> <p class="MsoNormal"><b><span style="font-size: 10pt; font-family: "Arial","sans-serif"; color: rgb(31, 73, 125);">KJ (Ken) Salchow, Jr.</span></b><span style="font-size: 10pt; font-family: "Arial","sans-serif"; color: rgb(31, 73, 125);"> | Manager, Technical Marketing</span><span style="font-size: 12pt; color: rgb(31, 73, 125);"><o:p></o:p></span></p> </td> </tr> <tr style="height: 9pt;"> <td style="padding: 0.75pt; width: 63pt; height: 9pt;" width="84"> <p class="MsoNormal" style="line-height: 9pt;"><b><span style="font-size: 7.5pt; font-family: "Arial","sans-serif"; color: rgb(51, 51, 51);">D 651.423.1133</span></b><span style="font-size: 12pt; font-family: "Times New Roman","serif"; color: rgb(31, 73, 125);"><o:p></o:p></span></p> </td> <td style="padding: 0.75pt; width: 63pt; height: 9pt;" width="84"> <p class="MsoNormal" style="line-height: 9pt;"><b><span style="font-size: 7.5pt; font-family: "Arial","sans-serif"; color: rgb(51, 51, 51);">M 612.868.1258</span></b><span style="font-size: 12pt; color: rgb(31, 73, 125);"><o:p></o:p></span></p> </td> <td style="padding: 0.75pt; width: 63pt; height: 9pt;" width="84"> <p class="MsoNormal" style="line-height: 9pt;"><b><span style="font-size: 7.5pt; font-family: "Arial","sans-serif"; color: rgb(51, 51, 51);">P 206.272.5555</span></b><span style="font-size: 12pt; color: rgb(31, 73, 125);"><o:p></o:p></span></p> </td> <td style="padding: 0.75pt; width: 63pt; height: 9pt;" width="84"> <p class="MsoNormal" style="line-height: 9pt;"><b><span style="font-size: 7.5pt; font-family: "Arial","sans-serif"; color: rgb(51, 51, 51);">F 206.272.5555</span></b><span style="font-size: 12pt; color: rgb(31, 73, 125);"><o:p></o:p></span></p> </td> <td style="padding: 0.75pt; width: 51.75pt; height: 9pt;" width="69"> <p class="MsoNormal" style="line-height: 9pt;"><b><span style="font-size: 7.5pt; font-family: "Arial","sans-serif"; color: rgb(51, 51, 51);"><a moz-do-not-send="true" href="http://www.f5.com/"><span style="color: rgb(51, 51, 51);">www.f5.com</span></a></span></b><span style="font-size: 12pt; color: rgb(31, 73, 125);"><o:p></o:p></span></p> </td> </tr> </tbody> </table> <p class="MsoNormal"><span style="color: rgb(31, 73, 125);" lang="EN-US"><o:p> </o:p></span></p> <p class="MsoNormal"><span style="color: rgb(31, 73, 125);" lang="EN-US"><o:p> </o:p></span></p> <div> <div style="border-style: solid none none; border-color: rgb(181, 196, 223) -moz-use-text-color -moz-use-text-color; border-width: 1pt medium medium; padding: 3pt 0cm 0cm;"> <p class="MsoNormal" style="margin-left: 36pt;"><b><span style="font-size: 10pt; font-family: "Tahoma","sans-serif";" lang="EN-US">From:</span></b><span style="font-size: 10pt; font-family: "Tahoma","sans-serif";" lang="EN-US"> <a class="moz-txt-link-abbreviated" href="mailto:[email protected]">[email protected]</a> [<a class="moz-txt-link-freetext" href="mailto:[email protected]">mailto:[email protected]</a>] <b>On Behalf Of </b>S. Stefán Sigurðsson<br> <b>Sent:</b> Friday, January 22, 2010 5:28 AM<br> <b>To:</b> <a class="moz-txt-link-abbreviated" href="mailto:[email protected]">[email protected]</a><br> <b>Subject:</b> [load balancing] L7 packet inspection<o:p></o:p></span></p> </div> </div> <p class="MsoNormal" style="margin-left: 36pt;"><span lang="EN-US"><o:p> </o:p></span></p> <p class="MsoNormal" style="margin-left: 36pt;"><span lang="EN-US">Hi, my company wants to start doing packet L7 inspection on all traffic going through the load balancer.<o:p></o:p></span></p> <p class="MsoNormal" style="margin-left: 36pt;"><span lang="EN-US"><o:p> </o:p></span></p> <p class="MsoNormal" style="margin-left: 36pt;"><span lang="EN-US">Now <span style="color: rgb(31, 73, 125);">m</span>y concern (cost aside) is how will I get the best performance possible, ever ms counts.<o:p></o:p></span></p> <p class="MsoNormal" style="margin-left: 36pt;"><span lang="EN-US"><o:p> </o:p></span></p> <p class="MsoNormal" style="margin-left: 36pt;"><span lang="EN-US">We are currently using an Ace module to do our SLB and it has the option of L7 inspect but will that perform any better than putting a good L7 firewall in front of the ACE.<o:p></o:p></span></p> <p class="MsoNormal" style="margin-left: 36pt;"><span lang="EN-US"><o:p> </o:p></span></p> <p class="MsoNormal" style="margin-left: 36pt;"><span lang="EN-US">We are still just in the concept stage of this plan so any advice or good idea would be greatly appreciated..<o:p></o:p></span></p> <p class="MsoNormal" style="margin-left: 36pt;"><o:p> </o:p></p> <p class="MsoNormal" style="margin-left: 36pt;">S. Stefan <o:p></o:p></p> </div> </div> <pre wrap=""> <fieldset class="mimeAttachmentHeader"></fieldset> _______________________________________________ lb-l mailing list <a class="moz-txt-link-abbreviated" href="mailto:[email protected]">[email protected]</a> <a class="moz-txt-link-freetext" href="http://vegan.net/mailman/listinfo/lb-l">http://vegan.net/mailman/listinfo/lb-l</a> Searchable Archive: <a class="moz-txt-link-freetext" href="http://vegan.net/lb/archive">http://vegan.net/lb/archive</a> <a class="moz-txt-link-freetext" href="http://lbdigest.com">http://lbdigest.com</a> Load Balancing Digest <a class="moz-txt-link-freetext" href="http://lbwiki.com">http://lbwiki.com</a> Load Balancing Wiki </pre> </blockquote> <br> </body> </html> --------------060308020702060003010101-- --===============0223053767== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ lb-l mailing list [email protected] http://vegan.net/mailman/listinfo/lb-l Searchable Archive: http://vegan.net/lb/archive http://lbdigest.com Load Balancing Digest http://lbwiki.com Load Balancing Wiki --===============0223053767==--