About two years ago I was raising money for an Enterprise Security Software start-up. We were looking at inspecting layers 1-3 and maybe 4. However, from the description in the article it sounds like VMWare is using Bayesian statistics to predict behavior. That was our plan as well. But we had an advantage.

We were using the S-Flow MIB to mirror the incoming packets which theoretically did not slow the network down other than for the samples being sent to the security engine. Other technologies like C-Flow won’t permit monitoring of each port. I suspect VMware is counting on using the resident CPU’s to do the deep packet inspection. I’d like to hear from them

The idea of using a VMware virtual machine environment is to get 60% to 80% or even 90% utilization out of each CPU and then create an additional virtual machine on the next CPU. How can you do this if you are probably using over half of your CPU cycles for security?

Saying you are going to inspect every packet in layers 1-4 and the application layer is akin to getting a freighter full of coffee beans and inspecting each bean at the port.

We have learned that statistical analysis will do an adequate job. Is it five nines? Probably not, but it still works by checking each layer perhaps five percent of the time.

Here is a link to thoughts and letters, writen amongst Value Network people, related to Armageddon and IT's potential to move humanity from self-destruction to self-control and community self-government:
http://www.bbc.co.uk/dna/h2g2/classic/A22477250
The larest entrey was:

""The nature of collectivist says: "It takes the village to raise a child". The nature of individualist says: "Who am I? I need to know!" The nature of knowledge says: "The culture of interdependence in serenity is the health of mutuality between the village and who we each are!"

"Currently, we are at a junction of history when the incompatibilities of the past collectivist ruling units, such as the various war machines and their specific contexts, are resisting the individualism that has taken on a corporate shape, and goes on acting as individuals, competing for survival in an unsustainable village. For both, the individual and the village, the genuine paradigm shift comes from discovering the passage from competing to completing, just like the village needs to do with great dedication when the child becomes a teen, in making room for the teen's deployment in the community."

"Failing to do so keeps the teen from getting to know who she/he is, therefore keeping her/him to take her/his place in the smooth running of the village. Our Western modern society is made of several generations in which the villages have been built to satisfy corporate individualism, supporting competition and forgetting about completion. As a result, the corporate agenda finds itself having to re-invent the wheel of life with artificial intelligence, leaving behind the cultivation needed for the village and the individual's continuity into maturing."

"The vacuum that this is creating is digging a groove which will collapse under the weight of indifference and ignorance merging in reply to injustice, as we see throughout human history. When the collapse becomes inevitable, all the war machines will be forced to merge into the corporate agenda, putting in place the artificial mechanisms to keep the masses of villages from interfering with the powers that be, who never had time to adjust to the assembling of going from competing to completing, but who suddenly, will have to behave according to the teens' uprise against the village."

"Instead of witnessing the beauty of a paradigm shift in serenity, the entity of terror-anti-terror is moving globalization with the forces of extreme tensions, which forces the governance of paradox rule upon humanity. The village and the teens have to learn quickly (and not in a hurry, so as to defeat the stress of extreme tensions), how to fill the vacuum with all that's been denied to get to the top by competing, as opposed to completing."

"My prayer and hope is to see 2.0 to serve the coming of 3.0 in the release of serenity between the village and the child - amen to God's Yes in us all..."

Benoit Couture

Thanks for your thoughtful comment. A lot can be done from a layer seven architecture, including selectively adding layer 4 rules/policies for enforcement/access/partitioning.

The challenge in migrating upstack from a layer 4 starting point is substantial. A typical pattern match architecture already absorbs plenty of processing power now tracking fuzzy, fluctuating exploits. Add to that the challenge of fully comprehending hundreds of protocols flowing between dozens of applications, operating systems and databases with thousands of known vulnerabilities now in a mesh of servers and mobile, mutating VMs.

The best layer 4 IPS (deep packet) system I've seen has some layer seven protection, most around a subset of MSFT server vulnerabilities. Protection isn't comprehensive for MSFT servers, but its better than protection for UNix/Linux, Oracle etc. Thats probably the best. Without comprehensive layer 7 protection (based on full knowledge of protocols AND vulnerabilities) there will be unneeded exposure.

Bottom line- the deep packet architectures already reeling with accuracy, tuning and processing/throughput challenges at the perimeter will have bigger problems protecting meshes of physical and virtual servers.

Hope that makes sense.

Greg

The rhetorical questions are all excellent points - but you've missed a much more fundamental issue. Deep packet inspection is broken today - even without virtualization, morphing of attacks and massive quantities of false positives generated by simple keyword matching.

The fact is - you can do very little with a packet - neither with intrusion prevention nor with extrusion prevention.

You need to examine at the application session level - not the packet level. Since an attack spans an entire session by definition, and since a session will be composed of a number of packets - the security appliance must perform session reassembly.

This is especially true regarding extrusion prevention where simple keyword patching in MS Office files is basically worthless.

Best regards
Danny Lieberman

You have teed up my next blog related to where netsec goes from here... with increasing perimeter evasion, more servers and databases facing the public network and the beginning of the end of deep packet as core IPS architecture. I hope to post before RSA or soon after.

Thanks,
Greg