HP to Sell Virus Throttling in Network Equipment

In a reversal from what we and others reported earlier, it looks like HP is going be selling their virus throttle. According to some reports (ZDNet AU, C|Net Asia, and Computer World, among many others who picked up the press release):

Hewlett-Packard Co. is planning to build virus-throttling technology into ProLiant servers and ProCurve switches starting in early 2005, an HP executive said today.

...

Those problems have been solved by making Virus Throttler available through a network driver, Redmond said today. Starting in early 2005, ProLiant servers with Windows Server 2003 and Windows Server 2000 will be able to download the driver and update their Insight Manager software to take advantage of the Virus Throttler product, he said.

Source: HP to release Virus Throttler for Windows in 2005, Computer World, written by Tom Krazit, November 30, 2004.

By placing it in the network layer, ie in ProCurve switches and ProLiant Servers, they can get the best placement of the approach and minimize the risk of subversion by a compromised host (which could, for example, simply unload the driver). We covered Williamson's throttling papers before on wormblog. Having developed such a tool for Sendmail, I can say that it works well at the application layer.

This will be a great boon to network infrastructure. Hopefully other switch vendors, like Cisco and Juniper, can and will adopt this approach. This development is also a great example of corporate research being turned into a product, providing positive results for the investment on HP's part. The virus throttle project was done by Williamson and his group at HP Labs, Bristol, England. Note, also, that Microsoft has adopted this in their Windows XP SP2 networking changes, affording those desktops similar stack level rate connection controls.