STATEFUL firewalls are the problem. It makes no sense to put stateful firewalls in front of server farms. Any mechanism that tracks state is a DDoS intensifier. If you're running services on ports 80 and 443, put stateless ACLs on the edge routers, running in hardware, that are capable of line rate. That protects you against traffic on inappropriate ports without creating a stateful DDoS vector. If you need to mitigate application-layer attacks, do it on the servers with something like mod_security. That way you can distribute the attack across the server farm instead of running a stateful choke point that risks bringing your whole site down.
Or just configure the STATEFUL firewall correctly to be in front of a web server and you achieve the same.
A misconfigured STATEFUL firewall is still just a misconfigured firewall.
"The first is a moral, no one should be allowed to die just because they are down on their luck."
Let them die. Seriously, let them die. The American people are so scared to die that it is fucking us up. I think there should be a lot more death in this country. Most laws made are the result (direct or indirect) of preventing someone else from dying. Fuck them. Lets say that someone gets ran over by a bus. We should not clean up the mess because we care how or why the person died. We should clean it up because its going to fucking stink if we do not.
"That is my point - I should not have to learn "the new way" unless I care. If I don't care, it should at least work."
Interesting, I have a buddy that has the same attitude towards Linux. No matter, your (and his) depreciated appetite to learn new things is gain for all of us that thrive on learning.
"Then why are you still using Windows? Maybe it's just me, but I think the point of new software meant to replace old software is to actually, you know, improve upon the older software."
Ummm, because in my opinion... IT IS AN IMPROVEMENT However, the speed of the OS is not one of the improvements... yet. This was the entire point of my previous post.
"Does anyone else see what's wrong with this statement?" Does anyone else see what's wrong with this statement?
You need to learn the difference between a statement and an opinion.
1.) I have found that a weeks worth of learning helps tremendously. Also if I am stumped on something, I just type "Name of problem vista" in google. For example "Turn off UAC Vista" Works for me. 2.) Hmm, UAC is one of the first things I disabled. 3.) I use OpenOffice, so I can't help ya here.
Hmm, I run Vista at home and Linux at work... you may have something here.
*shrug* From my personal experience with XP-64 and Vista-64, I don't get the "Vista is a crappy OS" statements. I benchmarked my system with both operating systems using 3DMark06. I turned off the services and other things I do not use (the same thing I do in XP). Vista was about 300 points slower, which equates to about a 4% performance drop on my system. Since everyone is complaining about performance, I would expect Microsoft updates and service packs to increase performance over time. There are a couple of issues that I think will get worked out over time: DX10 performance needs help and network transfers have some sort of bug that makes file transfers slow (which I hear is already addressed in the upcoming SP1). IMO some of these complaints remind me of things said in the Win98 vs WinXP days.
All in all, I would say that Vista is not a better performer. But since when has a new Microsoft OS been faster than the old Microsoft OS that it intended to replace? Sure I am losing 1.5 to 2.5 FPS in games, but I feel that is acceptable given the newness of the OS.
Which has nothing to do with "opening" the Verizon network to "non-Verizon" phones. Verizon will lose money if they don't lock "Verizon-provided" phones. Therefore I think it would take another class-action lawsuit (like the Sprint lawsuit linked via parent post) to get Verizon to stop sim-locking their phones.
I don't see how this is news. This is just a logical business step. The cellular company subsidizes cell phones with the intent on making up the cost on the cellular plan. So... How to make more money? Get a bunch of people to provide there own phones of course! Instant profit boost.
Now, what you will not see in the near future is Verizon unlocking the Verizon provided phones. That is unless they are commanded to do it via the US court system.
spanning tree won't stop this type of issue if the hubs are not STP capable. One way to stop this though would be to configure storm control on the closest capable device. You still lose whatever is on the controlled port, but the (b'cast, unicast or multicast) storm doesn't go beyond that port into the core.
Hmm, I have just the opposite issue. I am pushing for total wireless connectivity, but the users seem reluctant. I am slowly winning them over, but it seems to be an uphill battle. I don't have many issues at all with Wi-fi, but that is probably due to us using grid architecture (and I am fairly savvy at getting funding for it.) Fat APs just plain suck to manage when you have a bunch of them.
Slashdot Mirror
"Stateful firewalls are likely to fail under a DDOS attack because they keep track of connection requests until the table is full."
Is there a firewall that initiates an SPI entry from the outside to the inside (besides CBAC of course)? What would be the point of such a firewall?
Or just configure the STATEFUL firewall correctly to be in front of a web server and you achieve the same.
A misconfigured STATEFUL firewall is still just a misconfigured firewall.
Holy shit! We have found the Flying Spaghetti Monster!
v6
Yeah I can...
Almost as big as my tube.
What a fucking tard comment... and virus scanning is not done automatically either?
No comment on a AFIK statement
Linux=Debian bullshit again. Where is your argument for the rest of the distros?
ReiserFS - No comment
"The first is a moral, no one should be allowed to die just because they are down on their luck."
Let them die.
Seriously, let them die. The American people are so scared to die that it is fucking us up.
I think there should be a lot more death in this country. Most laws made are the result (direct or indirect) of preventing someone else from dying.
Fuck them. Lets say that someone gets ran over by a bus. We should not clean up the mess because we care how or why the person died. We should clean it up because its going to fucking stink if we do not.
The Aruba access points do not run linux. The Aruba mobility controllers do though.
You have to be 11 years old to be paid in comic books?
*disappointed*
From behind? Are you coming onto me?
That's gotta be the weirdest fetish I've ever heard of.
It's not really a fetish. It's just an excuse to come and post.
"That is my point - I should not have to learn "the new way" unless I care. If I don't care, it should at least work."
Interesting, I have a buddy that has the same attitude towards Linux. No matter, your (and his) depreciated appetite to learn new things is gain for all of us that thrive on learning.
http://www.google.com/search?source=ig&hl=en&rlz=&q=annoying+pop-up+box+that+gives+a+false+sense+of+security+vista&btnG=Google+Search
Don't even have to click on a result. Its in the google summaries.
Something similar is what I used to find out what the acronym was.
blah blah blah
Whatever, I will believe it when I see it.
"That wasn't a statement" posts in 3..2..1..
"Then why are you still using Windows? Maybe it's just me, but I think the point of new software meant to replace old software is to actually, you know, improve upon the older software."
Ummm, because in my opinion... IT IS AN IMPROVEMENT
However, the speed of the OS is not one of the improvements... yet.
This was the entire point of my previous post.
"Does anyone else see what's wrong with this statement?"
Does anyone else see what's wrong with this statement?
You need to learn the difference between a statement and an opinion.
1.) I have found that a weeks worth of learning helps tremendously. Also if I am stumped on something, I just type "Name of problem vista" in google. For example "Turn off UAC Vista" Works for me.
2.) Hmm, UAC is one of the first things I disabled.
3.) I use OpenOffice, so I can't help ya here.
Hmm, I run Vista at home and Linux at work... you may have something here.
*shrug* From my personal experience with XP-64 and Vista-64, I don't get the "Vista is a crappy OS" statements. I benchmarked my system with both operating systems using 3DMark06. I turned off the services and other things I do not use (the same thing I do in XP). Vista was about 300 points slower, which equates to about a 4% performance drop on my system. Since everyone is complaining about performance, I would expect Microsoft updates and service packs to increase performance over time. There are a couple of issues that I think will get worked out over time: DX10 performance needs help and network transfers have some sort of bug that makes file transfers slow (which I hear is already addressed in the upcoming SP1). IMO some of these complaints remind me of things said in the Win98 vs WinXP days.
All in all, I would say that Vista is not a better performer. But since when has a new Microsoft OS been faster than the old Microsoft OS that it intended to replace? Sure I am losing 1.5 to 2.5 FPS in games, but I feel that is acceptable given the newness of the OS.
Which has nothing to do with "opening" the Verizon network to "non-Verizon" phones. Verizon will lose money if they don't lock "Verizon-provided" phones. Therefore I think it would take another class-action lawsuit (like the Sprint lawsuit linked via parent post) to get Verizon to stop sim-locking their phones.
Correction: This is news, but not something that is /. worthy IMO.
I don't see how this is news. This is just a logical business step. The cellular company subsidizes cell phones with the intent on making up the cost on the cellular plan. So... How to make more money? Get a bunch of people to provide there own phones of course! Instant profit boost.
Now, what you will not see in the near future is Verizon unlocking the Verizon provided phones. That is unless they are commanded to do it via the US court system.
don't tell the mr poop sniffer spam guy
spanning tree won't stop this type of issue if the hubs are not STP capable.
One way to stop this though would be to configure storm control on the closest capable device.
You still lose whatever is on the controlled port, but the (b'cast, unicast or multicast) storm doesn't go beyond that port into the core.
Hmm, I have just the opposite issue. I am pushing for total wireless connectivity, but the users seem reluctant. I am slowly winning them over, but it seems to be an uphill battle. I don't have many issues at all with Wi-fi, but that is probably due to us using grid architecture (and I am fairly savvy at getting funding for it.) Fat APs just plain suck to manage when you have a bunch of them.
Point to point T1 over DSL, not that hard to imagine...
I think you misunderstood by thinking an ISP was involved in this.
google "pairgain"