Re: [Ila] [5gangip] ILA forwaring [Was Re: Problem Statement]

[Tom Herbert <[e-mail]>]

On Tue, May 1, 2018 at 2:59 PM, Alberto Rodriguez-Natal
<[e-mail]> wrote:
> On Tue, May 1, 2018 at 10:16 AM, Tom Herbert <[e-mail]> wrote:
>>
>> I think you've misunderstood my position. Caches are _very_ important
>> to eliminate the cost triangular routing (latency, average path load).
>> This reduces latency and reduces average load on ILA-Rs. But, and this
>> is the critical part, caches are only an _optimization_ in ILA. That
>> means if the cache is rendered ineffective (like by a well crafted DOS
>> attack) then the only effect is that the optimization is loss (i.e.
>> greater latency due to triangular router)-- this is quantitively the
>> worst effect of the attack on an ILA cache. This can be contrasted
>> that to LISP where the worst case effects of a DOS attack on the cache
>> is loss of service for users (infinite latency since packets can be
>> dropped or indefinitely blocked on a cache miss).
>
>
> This can be misleading. This is not comparing LISP vs ILA, this is comparing
> the models of Request/Reply at the edge vs Notifications (aka Redirects) at
> the core. Both LISP-CP and ILAMP support these two models.
>
> Besides, this is assuming an scenario where the only feasible DOS mitigation
> is absorbing the attack. There are other scenarios where other
> countermeasures are possible. For instance, if you have a deployment where
> you can prevent address spoofing, counting and blocking misbehaving nodes
> offers similar DOS protection and requires way less infrastructure
> resources.
>
Alberto,

The answer to my question of how does LISP address DOS attacks seems
to be "there are many options". Some of the options are to assume that
DOS does not exist in the network, some assume external configuration
like address spoofing is enabled, some assume that attacks can be
identified and can be stopped at the source, some might assume that
everything is okay because there's never been a DOS attack before. I
have yet to see the effects of any of these quantified, and none of
these state how the LISP _protocol_ itself addresses DOS. It may seem
counter-intuitive, but offering a bunch of options really is not
necessarily a good thing-- sometime less is more. To put this another
way LISP has been rejected from Linux precisely because of its
susceptibility to DOS. If you were to try again and the best answer to
the DOS question is that it's up to the operator to figure out the
right options to use, then I believe it would be soundly rejected
again. That approach does not work at scale.

Tom