Re: [RAM] Tunnelling Route Reduction Protocol

On 8/22/07, Brian E Carpenter <brian.e.carpenter@gmail.com> wrote:
> On 2007-08-21 15:30, William Herrin wrote:
> > 1. 99.9% of the time, the originator of the packet has already had to
> > do a DNS lookup or some other lookup to map a name to an IP address.
>
> Wouldn't that be 49.95%? Half of all first packets tend to be
> responses such as SYN/ACK that involve no DNS lookup.

Hi Brian,

Its still 99.9%; the return packet is part of the initial transaction.
But you're right, there are potentially two extra lookup delays on
that first transaction in addition to the original name to IP lookup.

If the network operator is sloppy then there could be more. If the DNS
resolver doesn't refer queries through a resolver on globally routable
space or the authoratative name to ip DNS server isn't on globally
routable space then there could be a dozen lookups to get to the point
where the two endpoints are talking and all pertinent routes are
cached.

That's avoided by good operations practice, so I'm not too worried about it.

> For a server
> handling thousands of requests per second, adding a lookup means
> holding thousands of TCBs in a wait state for the duration of the
> lookup. There are perhaps some interesting DDOS attacks there.

Shouldn't be much different that you see with SYN floods and SYN cookies now.

I suspect the worst DOS would involve sending packets to random
addresses. The ITR lookups run afoul of the same problem that Cisco
fast-switching did: overwhelming the cache. The ITR would have to take
care not to discard routes for sessions that have seen a lot of
packets in favor of pending lookups or routes that have only seen a
few packets.

Regards,
Bill Herrin

-- 
William D. Herrin                  herrin@dirtside.com  bill@herrin.us
3005 Crane Dr.                        Web: <http://bill.herrin.us/>
Falls Church, VA 22042-3004

_______________________________________________
RAM mailing list
RAM@iab.org
https://www1.ietf.org/mailman/listinfo/ram