Re: [lisp] [Ila] LISP for ILA

Would it be practical to have the map server, having detected an attack, simply send a cookie back in its reply to the spoofed address and then stop replying for a period of time to the spoofed source address unless subsequent requests from that source address contained the cookie in an opaque LCAF or some other LCAF type? 

Paul
________________________________________
From: lisp [lisp-bounces@ietf.org] on behalf of Dino Farinacci [farinacci@gmail.com]
Sent: Friday, March 16, 2018 2:41 PM
To: Tom Herbert
Cc: David Meyer; ila@ietf.org; lisp@ietf.org
Subject: Re: [lisp] [Ila]  LISP for ILA

> Detecting that something is under DOS attack is not problem. It’s

I do think it is a problem. Because you can’t tell sometimes if it is a high-rate due to high demand from good actors. From the mapping system’s perspective, you don’t know the traffic patterns so you don’t know that if a source-EID wants to talk to 100 EIDs if that is a good actor or a bad actor. If that source-EID is my phone, then it may be suspect, but if it’s a Google server talking to 100 phones, that is pretty normal.

> pretty obvious when a device is getting flooded which a bunch of
> spoofed SYNs for example. The problem is trying to find that one SYN
> packet in a thousand that is not part of the attack and is actually

Right, at cisco, we called that “the needle in the haystack problem”. And it comes up when we talk about topics of “punt path” in routers and DoS attacks.

> legitimate. Again this is not easy because the attacker is purposely
> trying to prevent this determination. AFAIK this is a generally

Yep, that’s right.

> unsolved problem and probably impossible to fully solve. So if the

Agree. We should look at the honey-pot solutions that DNS has used. But its a different animal though than packet attacks.

> reaction to the attack is to stop all requests and that one legitimate
> flow is blocked from making progress, then it would seen the DOS
> attack is successful.

That isn’t what would happen with the frequency-hopping idea. If the map-resolver is aggressive in dropping and it drops the needles, those ITRs have a back-up or parallel plan to get their requests resolved from other map-resolvers in the mapping system. Be them part of an anycast group or not.

Dino

_______________________________________________
lisp mailing list
lisp@ietf.org
https://www.ietf.org/mailman/listinfo/lisp