Re: [MBONED] [Msr6] MSR6 BOF 3rd Issue Category: More details are requested about the large scale use cases, including issue 8-11

[Toerless Eckert <[e-mail]>]

On Wed, Nov 02, 2022 at 03:11:45PM -0700, Dino Farinacci wrote:
> I'm not going to argue what has succeeded in the past or what has failed. They are subjective comments and are not productive for moving forward.
> 
> Removed text I'm not going to respond to.
> 
> My point was that its "easier to DoS attack a data-plane then a control-plane". I didn't make any other assertions about control-plane security.

Right, and that high level assertion is also subjective IMHO.
And my high level assertion is the opposite, and i tried to objectify
that assertion in my last email with a range of factual experiences.

Happy to learn about other means to better objectify our assertions.

> > MSDP was then (predictably ?) the first protocol that brought down
> > a good part of the Internet control plane when it was attacked UNINTENTIONAL:
> 
> This is simply not true. I was debugging such events at the time and the Internet was working or I wouldn't be able to debug it. ;-)

Hey, i said "a good part" ;-)

> > High level, you are arguing that control plane state is more trustworthy or
> > better controlled than packet header state, but IP multicast control plane state
> 
> No I am not. Its easier to get access to the data-plane by an ordinary user. So anyone can really attack the data-plane, and they might not even know it. I did not mention trust at all.

Every SP has packet level filters for destination addresses used
for inband managemnt, every router supports them at linerate.

Likewise, packet filter can/do filter unknown (extension)headers
as easily, even if arguably consistent support may be less universal
across vendors.

How and how well are routers IGMP/MLD control plane protected,
yes, i did see some of the protection commands trickle through
to other vendors after we'd implemented them first, but pretty sure
i can still find enough vendors not doing all we know to be necessary.

Cheers
    Toerless

> Dino
> 

-- 
---
[e-mail]