Re: L7 packet inspection
Jens Brey <[email protected]> Fri, 29 Jan 2010 10:28:27 +0100
| Newsgroups | gmane.comp.programming.load-balancing.general |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format. --===============1898621687== Content-Type: multipart/alternative; boundary="------------090200030809070407080406" This is a multi-part message in MIME format. --------------090200030809070407080406 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: quoted-printable X-MIME-Autoconverted: from 8bit to quoted-printable by soda.vegan.net id o0T9Scuo008314 Hi, I think for the website itself, some additional milliseconds of latency=20 should not matter and here you can easily put in some of the devices=20 which are recommended by the list. For the game itself, it's much more complicated. The problem I see is,=20 for the communication between the clients and the server you use your=20 own native proprietary protocol (at least, this is what i would do,=20 because this HTTP/XML/SOAP stuff is not really known for performance).=20 All this nice fanzy application firewalls, ADCs, whatever, will only=20 work on protocols which they known and this is the standard application=20 set of open and most used protocols, like HTTP, FTP, SMTP and so on. On=20 top of this, some of them offer stuff like SOAP/XML validation and=20 offloading, compression and so on. But, I would bet, the eveonline client-server protocol is not known to=20 them. So, to offload work from the servers to the=20 loadbalancers/firewalls/some network device you need the possibility, to=20 develop your own normalization application proxy which should run on=20 this device and now the air starts to begin thin... The most flexibility on loadbalancers I have seen yet, is the iRule=20 stuff running on the F5, but also this is far away from that you need. Some years in the past, I was also looking for something like this,=20 because we also run a application with a native proprietary protocol and=20 the only stuff I found at this time, was a SDK for Checkpoint firewalls. http://www.opsec.com/cp_products/opsec_sdk.html So, before you start to hire someone, who needs to dig in on a SDK for=20 this device, I would simply leave all this protection stuff on the=20 servers itself. Also the scaleout will work much better ;) If you see,=20 you need more power, simply add a server, instead of a bigger more=20 expensive network device. My recommendation is, let the network device do all the network security=20 stuff, like DoS filtering and let the servers do all the more=20 complicated stuff. Just my 2 Cents, Jens Am 28.01.2010 11:52, schrieb S. Stef=E1n Sigur=F0sson: > > We are running MMO you may have heard of www.eveonline.com=20 > <http://www.eveonline.com>, now our servers are spending a allot of=20 > power investigating/authenticating traffic to make sure users are not=20 > modifying their clients, trying sending inject their own commands or=20 > trying to hack account. We are looking into handing some of that work=20 > over to the SLB or the network in front. Currently we are just trying=20 > to see what options we have and we don't have any defined needs, we=20 > may even reprogram some of our code to fit the L7 capabilities. Only=20 > thing I can say for sure is that any increase in latency is really bad=20 > for us. > > *From:* [email protected] [mailto:[email protected]] *On=20 > Behalf Of *Kenneth Salchow > *Sent:* 27. jan=FAar 2010 20:35 > *To:* Load Balancing Mailing List > *Subject:* Re: [load balancing] L7 packet inspection > > Sorry for delayed response---was having too much fun in Europe. J > > Par usual, Ed, Tony and (increasingly) Surya have covered a lot of the=20 > bases here---what they didn't specifically call out, but intimated, is=20 > that you really didn't specify **what** you want to do at L7. That's=20 > a HUGE determination in what you look for and who you but it from. =20 > The products, prices and capabilities range quite widely---heck, even=20 > here at F5 we have several different capabilities from the basic L7=20 > capability in the ADC, to a protocol enforcement product to a=20 > full-fledged application firewall. Which solution makes the most=20 > sense totally depends on what you want to do. > > Instead of just throwing out various products and vendors=20 > generically---can you narrow down your goals a little? > > Thanks, > > *KJ (Ken) Salchow, Jr.* | Manager, Technical Marketing > > *D 651.423.1133* > > =09 > > *M 612.868.1258* > > =09 > > *P 206.272.5555* > > =09 > > *F 206.272.5555* > > =09 > > *www.f5.com <http://www.f5.com/>* > > *From:* [email protected] [mailto:[email protected]] *On=20 > Behalf Of *S. Stef=E1n Sigur=F0sson > *Sent:* Friday, January 22, 2010 5:28 AM > *To:* [email protected] > *Subject:* [load balancing] L7 packet inspection > > Hi, my company wants to start doing packet L7 inspection on all=20 > traffic going through the load balancer. > > Now my concern (cost aside) is how will I get the best performance=20 > possible, ever ms counts. > > We are currently using an Ace module to do our SLB and it has the=20 > option of L7 inspect but will that perform any better than putting a=20 > good L7 firewall in front of the ACE. > > We are still just in the concept stage of this plan so any advice or=20 > good idea would be greatly appreciated.. > > S. Stefan > > > _______________________________________________ > lb-l mailing list > [email protected] > http://vegan.net/mailman/listinfo/lb-l > Searchable Archive: http://vegan.net/lb/archive > http://lbdigest.com Load Balancing Digest > http://lbwiki.com Load Balancing Wiki > =20 --------------090200030809070407080406 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type"> </head> <body bgcolor="#ffffff" text="#000000"> Hi,<br> <br> I think for the website itself, some additional milliseconds of latency should not matter and here you can easily put in some of the devices which are recommended by the list.<br> <br> For the game itself, it's much more complicated. The problem I see is, for the communication between the clients and the server you use your own native proprietary protocol (at least, this is what i would do, because this HTTP/XML/SOAP stuff is not really known for performance). All this nice fanzy application firewalls, ADCs, whatever, will only work on protocols which they known and this is the standard application set of open and most used protocols, like HTTP, FTP, SMTP and so on. On top of this, some of them offer stuff like SOAP/XML validation and offloading, compression and so on.<br> <br> But, I would bet, the eveonline client-server protocol is not known to them. So, to offload work from the servers to the loadbalancers/firewalls/some network device you need the possibility, to develop your own normalization application proxy which should run on this device and now the air starts to begin thin... <br> <br> The most flexibility on loadbalancers I have seen yet, is the iRule stuff running on the F5, but also this is far away from that you need. <br> <br> Some years in the past, I was also looking for something like this, because we also run a application with a native proprietary protocol and the only stuff I found at this time, was a SDK for Checkpoint firewalls. <br> <a class="moz-txt-link-freetext" href="http://www.opsec.com/cp_products/opsec_sdk.html">http://www.opsec.com/cp_products/opsec_sdk.html</a><br> <br> So, before you start to hire someone, who needs to dig in on a SDK for this device, I would simply leave all this protection stuff on the servers itself. Also the scaleout will work much better ;) If you see, you need more power, simply add a server, instead of a bigger more expensive network device. <br> <br> My recommendation is, let the network device do all the network security stuff, like DoS filtering and let the servers do all the more complicated stuff. <br> <br> Just my 2 Cents,<br> Jens<br> <br> <br> Am 28.01.2010 11:52, schrieb S. Stefán Sigurðsson: <blockquote cite="mid:[email protected]" type="cite"> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> <meta name="Generator" content="Microsoft Word 12 (filtered medium)"> <style> <!-- /* Font Definitions */ @font-face {font-family:Wingdings; panose-1:5 0 0 0 0 0 0 0 0 0;} @font-face {font-family:"Cambria Math"; panose-1:2 4 5 3 5 4 6 3 2 4;} @font-face {font-family:Calibri; panose-1:2 15 5 2 2 2 4 3 2 4;} @font-face {font-family:Tahoma; panose-1:2 11 6 4 3 5 4 4 2 4;} /* Style Definitions */ p.MsoNormal, li.MsoNormal, div.MsoNormal {margin:0cm; margin-bottom:.0001pt; font-size:11.0pt; font-family:"Calibri","sans-serif";} a:link, span.MsoHyperlink {mso-style-priority:99; color:blue; text-decoration:underline;} a:visited, span.MsoHyperlinkFollowed {mso-style-priority:99; color:purple; text-decoration:underline;} span.EmailStyle17 {mso-style-type:personal; font-family:"Calibri","sans-serif"; color:windowtext;} span.EmailStyle18 {mso-style-type:personal; font-family:"Calibri","sans-serif"; color:#1F497D;} span.EmailStyle19 {mso-style-type:personal; font-family:"Calibri","sans-serif"; color:#1F497D;} span.EmailStyle20 {mso-style-type:personal-reply; font-family:"Calibri","sans-serif"; color:#1F497D;} .MsoChpDefault {mso-style-type:export-only; font-size:10.0pt;} @page Section1 {size:612.0pt 792.0pt; margin:70.85pt 70.85pt 70.85pt 70.85pt;} div.Section1 {page:Section1;} --> </style> <!--[if gte mso 9]><xml> <o:shapedefaults v:ext="edit" spidmax="1026" /> </xml><![endif]--><!--[if gte mso 9]><xml> <o:shapelayout v:ext="edit"> <o:idmap v:ext="edit" data="1" /> </o:shapelayout></xml><![endif]--> <div class="Section1"> <p class="MsoNormal"><span style="color: rgb(31, 73, 125);" lang="EN-US">We are running MMO you may have heard of <a moz-do-not-send="true" href="http://www.eveonline.com">www.eveonline.com</a>, now our servers are spending a allot of power investigating/authenticating traffic to make sure users are not modifying their clients, trying sending inject their own commands or trying to hack account. We are looking into handing some of that work over to the SLB or the network in front. Currently we are just trying to see what options we have and we don’t have any defined needs, we may even reprogram some of our code to fit the L7 capabilities. Only thing I can say for sure is that any increase in latency is really bad for us.<o:p></o:p></span></p> <p class="MsoNormal"><span style="color: rgb(31, 73, 125);"><o:p> </o:p></span></p> <p class="MsoNormal"><span style="color: rgb(31, 73, 125);"><o:p> </o:p></span></p> <p class="MsoNormal"><span style="color: rgb(31, 73, 125);"><o:p> </o:p></span></p> <p class="MsoNormal"><span style="color: rgb(31, 73, 125);"><o:p> </o:p></span></p> <p class="MsoNormal"><span style="color: rgb(31, 73, 125);"><o:p> </o:p></span></p> <p class="MsoNormal"><span style="color: rgb(31, 73, 125);"><o:p> </o:p></span></p> <div> <div style="border-style: solid none none; border-color: rgb(181, 196, 223) -moz-use-text-color -moz-use-text-color; border-width: 1pt medium medium; padding: 3pt 0cm 0cm;"> <p class="MsoNormal"><b><span style="font-size: 10pt; font-family: "Tahoma","sans-serif";" lang="EN-US">From:</span></b><span style="font-size: 10pt; font-family: "Tahoma","sans-serif";" lang="EN-US"> <a class="moz-txt-link-abbreviated" href="mailto:[email protected]">[email protected]</a> [<a class="moz-txt-link-freetext" href="mailto:[email protected]">mailto:[email protected]</a>] <b>On Behalf Of </b>Kenneth Salchow<br> <b>Sent:</b> 27. janúar 2010 20:35<br> <b>To:</b> Load Balancing Mailing List<br> <b>Subject:</b> Re: [load balancing] L7 packet inspection<o:p></o:p></span></p> </div> </div> <p class="MsoNormal"><o:p> </o:p></p> <p class="MsoNormal"><span style="color: rgb(31, 73, 125);" lang="EN-US">Sorry for delayed response—was having too much fun in Europe. </span><span style="font-family: Wingdings; color: rgb(31, 73, 125);" lang="EN-US">J</span><span style="color: rgb(31, 73, 125);" lang="EN-US"><o:p></o:p></span></p> <p class="MsoNormal"><span style="color: rgb(31, 73, 125);" lang="EN-US"><o:p> </o:p></span></p> <p class="MsoNormal"><span style="color: rgb(31, 73, 125);" lang="EN-US">Par usual, Ed, Tony and (increasingly) Surya have covered a lot of the bases here—what they didn’t specifically call out, but intimated, is that you really didn’t specify *<b>what</b>* you want to do at L7. That’s a HUGE determination in what you look for and who you but it from. The products, prices and capabilities range quite widely—heck, even here at F5 we have several different capabilities from the basic L7 capability in the ADC, to a protocol enforcement product to a full-fledged application firewall. Which solution makes the most sense totally depends on what you want to do.<o:p></o:p></span></p> <p class="MsoNormal"><span style="color: rgb(31, 73, 125);" lang="EN-US"><o:p> </o:p></span></p> <p class="MsoNormal"><span style="color: rgb(31, 73, 125);" lang="EN-US">Instead of just throwing out various products and vendors generically—can you narrow down your goals a little? <o:p></o:p></span></p> <p class="MsoNormal"><span style="color: rgb(31, 73, 125);" lang="EN-US"><o:p> </o:p></span></p> <p class="MsoNormal"><span style="color: rgb(31, 73, 125);" lang="EN-US">Thanks,<o:p></o:p></span></p> <p class="MsoNormal"><span style="color: rgb(31, 73, 125);" lang="EN-US"><o:p> </o:p></span></p> <div> <table class="MsoNormalTable" style="width: 318.75pt;" width="425" border="0" cellpadding="0"> <tbody> <tr> <td colspan="5" style="padding: 0.75pt;"> <p class="MsoNormal"><b><span style="font-size: 10pt; font-family: "Arial","sans-serif"; color: rgb(31, 73, 125);">KJ (Ken) Salchow, Jr.</span></b><span style="font-size: 10pt; font-family: "Arial","sans-serif"; color: rgb(31, 73, 125);"> | Manager, Technical Marketing</span><span style="font-size: 12pt; color: rgb(31, 73, 125);"><o:p></o:p></span></p> </td> </tr> <tr style="height: 9pt;"> <td style="padding: 0.75pt; width: 63pt; height: 9pt;" width="84"> <p class="MsoNormal" style="line-height: 9pt;"><b><span style="font-size: 7.5pt; font-family: "Arial","sans-serif"; color: rgb(51, 51, 51);">D 651.423.1133</span></b><span style="font-size: 12pt; font-family: "Times New Roman","serif"; color: rgb(31, 73, 125);"><o:p></o:p></span></p> </td> <td style="padding: 0.75pt; width: 63pt; height: 9pt;" width="84"> <p class="MsoNormal" style="line-height: 9pt;"><b><span style="font-size: 7.5pt; font-family: "Arial","sans-serif"; color: rgb(51, 51, 51);">M 612.868.1258</span></b><span style="font-size: 12pt; color: rgb(31, 73, 125);"><o:p></o:p></span></p> </td> <td style="padding: 0.75pt; width: 63pt; height: 9pt;" width="84"> <p class="MsoNormal" style="line-height: 9pt;"><b><span style="font-size: 7.5pt; font-family: "Arial","sans-serif"; color: rgb(51, 51, 51);">P 206.272.5555</span></b><span style="font-size: 12pt; color: rgb(31, 73, 125);"><o:p></o:p></span></p> </td> <td style="padding: 0.75pt; width: 63pt; height: 9pt;" width="84"> <p class="MsoNormal" style="line-height: 9pt;"><b><span style="font-size: 7.5pt; font-family: "Arial","sans-serif"; color: rgb(51, 51, 51);">F 206.272.5555</span></b><span style="font-size: 12pt; color: rgb(31, 73, 125);"><o:p></o:p></span></p> </td> <td style="padding: 0.75pt; width: 51.75pt; height: 9pt;" width="69"> <p class="MsoNormal" style="line-height: 9pt;"><b><span style="font-size: 7.5pt; font-family: "Arial","sans-serif"; color: rgb(51, 51, 51);"><a moz-do-not-send="true" href="http://www.f5.com/"><span style="color: rgb(51, 51, 51);">www.f5.com</span></a></span></b><span style="font-size: 12pt; color: rgb(31, 73, 125);"><o:p></o:p></span></p> </td> </tr> </tbody> </table> <p class="MsoNormal"><span style="color: rgb(31, 73, 125);" lang="EN-US"><o:p> </o:p></span></p> <p class="MsoNormal"><span style="color: rgb(31, 73, 125);" lang="EN-US"><o:p> </o:p></span></p> <div> <div style="border-style: solid none none; border-color: rgb(181, 196, 223) -moz-use-text-color -moz-use-text-color; border-width: 1pt medium medium; padding: 3pt 0cm 0cm;"> <p class="MsoNormal" style="margin-left: 36pt;"><b><span style="font-size: 10pt; font-family: "Tahoma","sans-serif";" lang="EN-US">From:</span></b><span style="font-size: 10pt; font-family: "Tahoma","sans-serif";" lang="EN-US"> <a class="moz-txt-link-abbreviated" href="mailto:[email protected]">[email protected]</a> [<a class="moz-txt-link-freetext" href="mailto:[email protected]">mailto:[email protected]</a>] <b>On Behalf Of </b>S. Stefán Sigurðsson<br> <b>Sent:</b> Friday, January 22, 2010 5:28 AM<br> <b>To:</b> <a class="moz-txt-link-abbreviated" href="mailto:[email protected]">[email protected]</a><br> <b>Subject:</b> [load balancing] L7 packet inspection<o:p></o:p></span></p> </div> </div> <p class="MsoNormal" style="margin-left: 36pt;"><span lang="EN-US"><o:p> </o:p></span></p> <p class="MsoNormal" style="margin-left: 36pt;"><span lang="EN-US">Hi, my company wants to start doing packet L7 inspection on all traffic going through the load balancer.<o:p></o:p></span></p> <p class="MsoNormal" style="margin-left: 36pt;"><span lang="EN-US"><o:p> </o:p></span></p> <p class="MsoNormal" style="margin-left: 36pt;"><span lang="EN-US">Now <span style="color: rgb(31, 73, 125);">m</span>y concern (cost aside) is how will I get the best performance possible, ever ms counts.<o:p></o:p></span></p> <p class="MsoNormal" style="margin-left: 36pt;"><span lang="EN-US"><o:p> </o:p></span></p> <p class="MsoNormal" style="margin-left: 36pt;"><span lang="EN-US">We are currently using an Ace module to do our SLB and it has the option of L7 inspect but will that perform any better than putting a good L7 firewall in front of the ACE.<o:p></o:p></span></p> <p class="MsoNormal" style="margin-left: 36pt;"><span lang="EN-US"><o:p> </o:p></span></p> <p class="MsoNormal" style="margin-left: 36pt;"><span lang="EN-US">We are still just in the concept stage of this plan so any advice or good idea would be greatly appreciated..<o:p></o:p></span></p> <p class="MsoNormal" style="margin-left: 36pt;"><o:p> </o:p></p> <p class="MsoNormal" style="margin-left: 36pt;">S. Stefan <o:p></o:p></p> </div> </div> <pre wrap=""> <fieldset class="mimeAttachmentHeader"></fieldset> _______________________________________________ lb-l mailing list <a class="moz-txt-link-abbreviated" href="mailto:[email protected]">[email protected]</a> <a class="moz-txt-link-freetext" href="http://vegan.net/mailman/listinfo/lb-l">http://vegan.net/mailman/listinfo/lb-l</a> Searchable Archive: <a class="moz-txt-link-freetext" href="http://vegan.net/lb/archive">http://vegan.net/lb/archive</a> <a class="moz-txt-link-freetext" href="http://lbdigest.com">http://lbdigest.com</a> Load Balancing Digest <a class="moz-txt-link-freetext" href="http://lbwiki.com">http://lbwiki.com</a> Load Balancing Wiki </pre> </blockquote> <br> </body> </html> --------------090200030809070407080406-- --===============1898621687== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ lb-l mailing list [email protected] http://vegan.net/mailman/listinfo/lb-l Searchable Archive: http://vegan.net/lb/archive http://lbdigest.com Load Balancing Digest http://lbwiki.com Load Balancing Wiki --===============1898621687==--