Re: [lisp] [Ila] LISP for ILA

Paul Vinciguerra <> Fri, 16 March 2018 18:55 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 0E538129515; Fri, 16 Mar 2018 11:55:07 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.911
X-Spam-Status: No, score=-1.911 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham autolearn_force=no
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id 2O72J_KV2PNE; Fri, 16 Mar 2018 11:55:05 -0700 (PDT)
Received: from ( []) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 26F66120727; Fri, 16 Mar 2018 11:55:05 -0700 (PDT)
Received: from NYDC-EXCH01.vinci-consulting-corp.local ([]) by NYDC-EXCH01.vinci-consulting-corp.local ([]) with mapi id 14.03.0382.000; Fri, 16 Mar 2018 14:55:04 -0400
From: Paul Vinciguerra <>
To: Dino Farinacci <>, Tom Herbert <>
CC: David Meyer <>, "" <>, "" <>
Thread-Topic: [lisp] [Ila] LISP for ILA
Thread-Index: AQHTvVBz4T7HchHQ0E6gWEVuZ7dMSaPTbAwAgAAEGQCAAAUhgP//vjOw
Date: Fri, 16 Mar 2018 18:55:03 +0000
Message-ID: <B5A8E79CDD2131468993EFC2426361DD9FB450C3@NYDC-EXCH01.vinci-consulting-corp.local>
References: <> <> <> <> <> <> <> <> <> <> <> <>, <>
In-Reply-To: <>
Accept-Language: en-US
Content-Language: en-US
x-originating-ip: []
Content-Type: text/plain; charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Archived-At: <>
Subject: Re: [lisp] [Ila] LISP for ILA
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Fri, 16 Mar 2018 18:55:07 -0000

Would it be practical to have the map server, having detected an attack, simply send a cookie back in its reply to the spoofed address and then stop replying for a period of time to the spoofed source address unless subsequent requests from that source address contained the cookie in an opaque LCAF or some other LCAF type? 

From: lisp [] on behalf of Dino Farinacci []
Sent: Friday, March 16, 2018 2:41 PM
To: Tom Herbert
Cc: David Meyer;;
Subject: Re: [lisp] [Ila]  LISP for ILA

> Detecting that something is under DOS attack is not problem. It’s

I do think it is a problem. Because you can’t tell sometimes if it is a high-rate due to high demand from good actors. From the mapping system’s perspective, you don’t know the traffic patterns so you don’t know that if a source-EID wants to talk to 100 EIDs if that is a good actor or a bad actor. If that source-EID is my phone, then it may be suspect, but if it’s a Google server talking to 100 phones, that is pretty normal.

> pretty obvious when a device is getting flooded which a bunch of
> spoofed SYNs for example. The problem is trying to find that one SYN
> packet in a thousand that is not part of the attack and is actually

Right, at cisco, we called that “the needle in the haystack problem”. And it comes up when we talk about topics of “punt path” in routers and DoS attacks.

> legitimate. Again this is not easy because the attacker is purposely
> trying to prevent this determination. AFAIK this is a generally

Yep, that’s right.

> unsolved problem and probably impossible to fully solve. So if the

Agree. We should look at the honey-pot solutions that DNS has used. But its a different animal though than packet attacks.

> reaction to the attack is to stop all requests and that one legitimate
> flow is blocked from making progress, then it would seen the DOS
> attack is successful.

That isn’t what would happen with the frequency-hopping idea. If the map-resolver is aggressive in dropping and it drops the needles, those ITRs have a back-up or parallel plan to get their requests resolved from other map-resolvers in the mapping system. Be them part of an anycast group or not.


lisp mailing list