Protect Network Traffic With Latest Security GearProtect Network Traffic With Latest Security Gear

Distributed denial-of-service attacks are among the most difficult Internet threats to thwart and can be costly if they put an E-commerce site out of commission. Web sites such as eBay and Yahoo have suffered these attacks, which flood the site with page requests and prevent legitimate traffic from accessing it. To fight such attacks, Israeli startup Riverhead Networks this month is expected to unveil security gear that uses a new approach to help large companies and Internet service providers defend themselves.

Cervalis Inc. started testing Riverhead's Guard hardware and software device in January, says Edward Rabinovitch, VP of global networks and infrastructure operations at the Stamford, Conn., outsourcer and managed hosting vendor. He chose Guard over competitors because the software doesn't attempt to dynamically reconfigure customer access lists to sidestep an attack, which many anti-denial-of-service-attack applications do. That approach can end up blocking good traffic. Guard passively monitors network traffic and stops only malicious traffic. "We created our own denial-of-service attack, and Guard stopped the illegitimate traffic while legitimate users could still get through," he says. During the simulated attacks, traffic moved without problem when Guard was running; without it, traffic was delayed up to five minutes.

Cervalis is waiting for the final code before deciding whether to run Guard on the networks that support its customers. Until then, he says Cervalis will continue using the test version to protect its own Web site. Riverhead Guard is expected to be available on May 28; pricing will start at $80,000.

Guard can be configured to monitor traffic from a variety of points on a network, says Anat Bremler-Barr, chief scientist at Riverhead. It can sit adjacent to a router or switch and watch traffic from a port not used for normal network traffic, so it doesn't interfere when no attack is under way. Once an attack occurs, traffic is diverted to Guard, where it's identified and cleansed; only legitimate traffic is passed through.