WOODLAND, CALIF. - Start-up Captus Networks has developed high-speed equipment that sits behind the WAN router to detect surges in incoming IP traffic that might signal a denial-of-service attack has begun on corporate servers.

The Captus equipment, which can also act as a high-speed firewall, is designed to curb denial-of-service attacks before they cripple user networks. It aims to stop attacks by throttling back the questionable traffic to identify denial-of-service packets vs. legitimate traffic. It also checks for spoofed network addresses by making a request for response and acknowledgement. Denial-of-service traffic is usually spoofed, and the Captus equipment is set up to deny this attack traffic or redirect it to another server for forensics purposes.

There are many varieties of denial-of-service attacks, including distributed denial-of-service attacks that originate as packets fired from multiple sources at a target server but controlled remotely through one host computer. Rich Helgeson, president of Captus, isn't ready to say the Captus equipment will stop every denial-of-service attack ever invented, but he says it can limit most of them.

"The Captus equipment will stop most [denial-of-service] attacks in 10 seconds, Helgeson claims. Captus makes two versions of its product, the CaptIO, a 17-inch-by-1.75-inch single-rack box with 12 Fast Ethernet interfaces that costs $40,000, and its cousin, the CaptIO-G with one Gigabit Ethernet and eight Fast Ethernet interfaces, which sells for $55,000.

This equipment uses what Captus calls its "traffic limiting intrusion detection system" to notify network professionals of traffic surges, letting the company redirect suspect traffic. Captus last fall fielded an earlier version of its firewall/intrusion-detection device, which could sense unusual aggregate traffic patterns, but couldn't sort the good traffic from the bad.

Web hosting giant Exodus Communications has tested the Captus equipment in its lab and its data facilities, and is close to offering it as an anti-denial-of-service, value-added service to its customers.

"We're looking at it as the basis for managed security services," says Scheron Briones, director of network technologies at Exodus, who says the Captus gear appears to achieve its claim of stopping denial-of-service attacks. As a managed service provider, Exodus would manage the Captus equipment in its facility for customers, offering denial-of-service response services on a value-added basis. Briones says Exodus hasn't figured out a pricing model for all this, however.

The Captus equipment - which competes against firewall and intrusion-detection security gear from Nokia, Check Point, Internet Security Systems, Cisco and Arbor Networks, among others - is also being tested at NASA Ames, recently renamed the NASA Advanced Supercomputing Division.

"This device is more of a firewall for us than anything else, and it reaches gigabit speeds," says Derek Shaw, IT security group lead at the NASA location. At NASA, a lot of aerodynamics testing is conducted through simulation on supercomputers, and NASA uses the CaptIO-G product as a firewall inside the network, which reaches gigabit speeds.

http://www.nwfusion.com

• Email
• Print
• Share
  • Slashdot
  • Digg
  • Stumble
  • Reddit
  • Newsvine