Network Security White Papers
A Network Intrusion Detection System on IXP1200 Network Processors With Support for Large Rule Sets
Overview This paper describes a network intrusion detection system implemented on the IXP1200 network processor. It is aimed at detecting worms at high speeds by matching the payload of network packets against worm signatures at the lowest possible levels of the processing hierarchy (the microengines of an IXP1200 network processor). The solution employs the Aho-Corasick algorithm in a parallel fashion, where each microengine processes a subset of the network traffic. To allow for large patterns as well as a large number of rules, the signatures are stored in off-chip memory. Using an old version of the IXP network processors (the IXP1200), the system is capable of handling close to 200 Mbps with full content scan for realistic threats.
| Publisher | Vrije Universiteit | File Format | |
|---|---|---|---|
| Date Published | February 2004 | ||
| Format | White Papers | ||
| Topics | |||
-
Did you find this white paper useful? 3 out of 6 users found this white paper useful
White Paper RSS
Download
Register
