Re: [lisp] [Ila] LISP for ILA

Tom Herbert <> Fri, 16 March 2018 17:58 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 92597127369 for <>; Fri, 16 Mar 2018 10:58:46 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.6
X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (2048-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id gpmM0CRctGr6 for <>; Fri, 16 Mar 2018 10:58:44 -0700 (PDT)
Received: from ( [IPv6:2a00:1450:400c:c09::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 4A7C812D77D for <>; Fri, 16 Mar 2018 10:58:44 -0700 (PDT)
Received: by with SMTP id h21so4550248wmd.1 for <>; Fri, 16 Mar 2018 10:58:44 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-transfer-encoding; bh=ET1iGzp7jz+1aXuWNijNM8hJkJVJfkEVsPUgVbpaSD4=; b=Dp/MkoWchQiFZz5XHO6tRfjAaDxT02RHJ2GxG8KGFZ5uHFXLsd1go6jqncnpRQwvAN yuPu8PpXVGg1AbdBoOQKb28xK+ChRgEprpoXuWvSzZjTXCQvby/AomBvmCpacEWNwibg Avw49jILWlU+FhLMR0VQUATavD6GvNOTwV8G3KMSR/76gbF+Z3sGPrC+VeIpUwnO71FQ H1m+3R7chKJUH1m/Sve1OUggNH1woiaBh3lsdUBQTwdrOMtsouPJq0LMpx1FxwmwGddO tHl1KKKeV0QMwyGFmzy0L4AOedGXcgjK04YNDBl40myuhAnQxSkm3RUli8qu3OVjb+nT QiSQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=ET1iGzp7jz+1aXuWNijNM8hJkJVJfkEVsPUgVbpaSD4=; b=lrXvhi4pwdzhueJRvwUJg5OjoFs7ux7lfZ9YP0mnnoXZGnUDkCX1FFzOCPjmT/ZEzT r/rYg3JY7GRVwhYrP4GQmPefWglfzqXf+rYfl+Qn25ZLw2s/G5WzS62d5+W3sfeM4EKK WKd/RKpUvI3UcG8eaLIvE6CBbOkdN5anRz8GXpFWZGsiOjhsJn+CEkPKSs10Sll0ILYK iP83xzIsyCjHamVN7Kzc6Oq5B90cfvwso6Gl6FH3sHpBWcwGu0txOd2CK/S43V7gYN5U UAwBgvC2TNt/jmG5KNuZQXqPTmhWm+xx629OGJkmfhFGoFlmkFwkSoLwb0rivKuUtFdh QnSA==
X-Gm-Message-State: AElRT7G4oICQRrH+HiBnopdLgCvT/+HuszhOI4hEjydRAZ756Apq9Q0E KetZ8NCld6fpxhm76fdpFyHDUNI5g6luzb8hyBm6Zw==
X-Google-Smtp-Source: AG47ELvsY3d6qnXUI+dYAuG0Y+csw4RvcyFfglLuGvL4ghZX+bj7gMWgyKyMiKCsH3XpG9egqlyjnSCEr2jFIics48s=
X-Received: by with SMTP id l202mr2319243wmb.32.1521223122717; Fri, 16 Mar 2018 10:58:42 -0700 (PDT)
MIME-Version: 1.0
Received: by with HTTP; Fri, 16 Mar 2018 10:58:42 -0700 (PDT)
In-Reply-To: <>
References: <> <> <> <> <> <> <> <> <>
From: Tom Herbert <>
Date: Fri, 16 Mar 2018 10:58:42 -0700
Message-ID: <>
To: Dino Farinacci <>
Cc: Florin Coras <>, "Alberto Rodriguez Natal (natal)" <>, "" <>, "" <>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Archived-At: <>
Subject: Re: [lisp] [Ila] LISP for ILA
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Fri, 16 Mar 2018 17:58:47 -0000

On Fri, Mar 16, 2018 at 10:38 AM, Dino Farinacci <> wrote:
>> Attackers don't typically set the evil bit in packets and will
>> otherwise try to make their packets indistiguishable from legitimate
>> traffic. Can you provide a reference to a specific solution with an
>> algorithm that is able separate the bad packets from the good packets
>> wrt the cache.
> All you can really do to solve this problem is (from the perspective of a LISP Map-Resolver):
> (1) You sent a request for an EID too often, I’m dropping future requets from you.
> (2) You sent a request for any EID too often, I’m dropping future requests from you.
> (3) I am getting too many requests for an EID from many sources, start dropping them.
> (4) I am getting too many requests on this specific map-resolver address, I’m going to deconfigure it. If its an anycast-address, the requests will start going to the next closest map-resolver.
> (5) I am getting too many requests on this specific map-resolver address, I’m going to deconfigure it. If it is not an anycast-address, packets are dropped by my penultimate hop. Good actors know other map-resolvers to send to, to get their requests resolved.
> (6) Do (4) and (5) by withdrawing the route from BGP. So the high-rate of requests get dropped closer to the bad actors.
> In (4)-(6), I have referred to this as “solving DoS attacks with frequency-hopping techniques”. And I was thinking of doing it *with no signalling*. So good actors have to be robust to send to other map-resolvers, either serially or in parallel.
> Comments?

I'm pretty confused by who "I" is, who "you" is, as well as what
constitutes "too often" or "too many requests". Is there a normative
descirption of this algorithm we can look at?


> Dino