Fight Back Against Attacks

When distributed denial-of-service attacks strike, the damage is swift and furious. The waves of illegitimate requests that flood Web servers until they stop working can be sent from thousands of infected computer systems, at the specific moment they're told to strike. And when they do, engineers at the targeted site had better be ready.

"A distributed denial-of-service attack is the worst," says Tony Gauvin, VP of software and operations for New York financial-services firm ElephantX Online Securities LLC. Engineers at targeted companies spend hours trying to determine why their service has degraded, why their systems are getting hit with so many requests, and how to filter the good requests from the bad. "It's terrorism and it's vandalism," Gauvin says. "And the worst part is, a [denial-of-service] attack is easy to launch."

Much easier to launch than to defend against, in fact. To protect itself, ElephantX turned to new software from Mazu Networks Inc. The TrafficMaster Inspector system performs passive monitoring and filtering along key parts of a network, such as the core of the data center, to ensure attack packets are detected as far upstream as possible. If denial-of-service traffic is spotted, a filtering tool helps separate the good requests from the bad.

Mazu isn't the only vendor in the denial-of-service arena. Last week, Asta Networks Inc. unveiled Vantage System, which uses network-appliance sensors to collect router-traffic data and servers that collect and analyze the data, to create a complete view of network activity.

While both products can be used directly by IT managers, Gartner analyst John Pescatore says he expects all but the largest companies to buy denial-of-service protection as a service from their Internet service provider or hosting provider. "For most enterprises, once these types of attacks hit their network, it's too late to be effective," he says.

Asta's Vantage System will be available at the end of the month for $5,000 per sensor, plus a monthly fee based on the amount of protected bandwidth. Mazu Networks' TrafficMaster Inspector is available now for $100,000.