Re: [Ila] [lisp] LISP for ILA

[Tom Herbert <[e-mail]>]

On Fri, Mar 16, 2018 at 10:38 AM, Dino Farinacci <[e-mail]> wrote:
>> Attackers don't typically set the evil bit in packets and will
>> otherwise try to make their packets indistiguishable from legitimate
>> traffic. Can you provide a reference to a specific solution with an
>> algorithm that is able separate the bad packets from the good packets
>> wrt the cache.
>
> All you can really do to solve this problem is (from the perspective of a LISP Map-Resolver):
>
> (1) You sent a request for an EID too often, I’m dropping future requets from you.
>
> (2) You sent a request for any EID too often, I’m dropping future requests from you.
>
> (3) I am getting too many requests for an EID from many sources, start dropping them.
>
> (4) I am getting too many requests on this specific map-resolver address, I’m going to deconfigure it. If its an anycast-address, the requests will start going to the next closest map-resolver.
>
> (5) I am getting too many requests on this specific map-resolver address, I’m going to deconfigure it. If it is not an anycast-address, packets are dropped by my penultimate hop. Good actors know other map-resolvers to send to, to get their requests resolved.
>
> (6) Do (4) and (5) by withdrawing the route from BGP. So the high-rate of requests get dropped closer to the bad actors.
>
> In (4)-(6), I have referred to this as “solving DoS attacks with frequency-hopping techniques”. And I was thinking of doing it *with no signalling*. So good actors have to be robust to send to other map-resolvers, either serially or in parallel.
>
> Comments?
>
Dino,

I'm pretty confused by who "I" is, who "you" is, as well as what
constitutes "too often" or "too many requests". Is there a normative
descirption of this algorithm we can look at?

Thanks,
Tom

> Dino
>
>
>
>