Forum Discussion
funkdaddy_31014
Apr 21, 2011Nimbostratus
Addressing Vulnerabilities - Presence of a Load-Balancing Device Detected
We routinely run Qualys scans on our environment, and the scan comes back with minor vulnerabilities called "Presence of a Load-Balancing Device Detected" based on "IP Identification". The results sho...
hooleylist
Apr 17, 2012Cirrostratus
This seems like a non-issue. What can attacker do once they determine that a site is using a load balancer?
NMAP or online scans can generally fingerprint the OS of a site to provide more detail. For instance, example.com shows it's being hosted by a BIG-IP:
http://searchdns.netcraft.com/?restriction=site+ends+with&host=example.com
So an attacker even knows the vendor of the load balancer. It still begs the question of what can they do with that information?
You could try to change the behavior of BIG-IP to hide itself, but that would involve modifying TCP/UDP/iCMP behavior at a fairly low level. Is it really worth it to tinker with performance optimized settings to try to hide this minimal amount of information? I think it's better to invest time securing the infrastructure with timely patching, pentesting, etc versus worrying about OS fingerprinting.
Aaron
Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects