I may be answering my own question here but
need some reinforcement….

Q. We are proactively stress testing our new web site at work and use a
trialware app called Velometer to simulate database queries and user
sessions. I occurred to me that if someone wanted to bring down the site,
(and there are million dollar companies we’re putting out of business if the
site succeeds), all they make need to do is run Velometer, and simulate
3000 SQL queries to if not kill SQL, at least chew up our bandwidth.

So, to tie this into Cisco, what is the best defense???

I was thinking how do I limit bandwidth on a source address??
Do I use the IDS ?

OR,…..is that what that, “embryonic” PIX command is for???

The PIX would see the TCP sessions climb to an alarming rate, in an
alarming time span, and close the sessions to a configurable amount??

Believe it or not, this is a question!!

Help..

Kip Palmer

Report this post to a moderator

This is a good example of what TCP intercept on most firewalls would be good for. Unless you're completing the 3 way handshake (which would be dumb is you're a cracker since it would identify you; you would instead use forged source addresses) the firewall would either start dropping the half open connections in active mode or start sending FINs to the target if it was in passive mode.
Without doing this on a distributed basis, it would be very difficult to simply chew up a target's bandwidth. After all, how many people have an OC-3 set aside for mischievious uses?

MadChef

Report this post to a moderator

Intercepting such attacks "if distributed" on the PIX wouldn`t keep your bandwidth from getting hosed if for instance it is fairly limited.
If you have a good relationship with your ISP you could have them block that for you but I wouldn`t recomend it until after a attack.
Does this sound reasonable?

__________________
Check out my music at
www.chodan.com
Rural Development in Eastern Ky.
www.centertech.com
"It is our decisions that show us what we truly are in life, not our abilities."

Report this post to a moderator

Bandwidth is 5mg ATM.
So, what's actually going to catch and block it on the PIX? Floodgaurd? Embrionic sessions? Help..

Thanks

Report this post to a moderator