Re: [v6ops] draft-gont-v6ops-ipv6-ehs-in-real-world: clarification text

On Tue, Apr 21, 2015 at 11:45 AM, Joe Touch <touch@isi.edu> wrote:
>
>
> On 4/20/2015 11:48 PM, Gert Doering wrote:
>> Hi,
>>
>> On Mon, Apr 20, 2015 at 02:28:08PM -0700, Joe Touch wrote:
>>> On 4/20/2015 2:21 PM, Gert Doering wrote:
>>>> On Mon, Apr 20, 2015 at 08:43:28AM -0700, Joe Touch wrote:
>>>>>> If for some reasons, a router in the middle needs access to layer-4
>>>>>                                               ^^^^^
>>>>>> information (IPFIX? DDoS mitigation? ... ?), then the EH chain must be
>>>>>> parsed which can cause a performance impact.
>>>> [..]
>>>>>    1) this is the router vendor's decision, not a requirement
>>>>>    of Internet routers
>>>>
>>>> So, please tell me how you build an Internet router that is able to
>>>> defend itself against control plane abuse and does not need to look into
>>>> L4 to do so?
>>>
>>> A router can protect its own control plane by looking at the packet
>>> contents, but then it is acting as a host at that point and should be
>>> looking there only for packets addressed to interfaces of that router.
>>> That's not a forwarding function and thus doesn't limit the forwarding
>>> plane.
>>
>> Of course, but real world requires that this filter function needs to be
>> implemented in the forwarding plane, because otherwise packets would just
>> saturate the link between forwarding and control plane if you would only
>> filter on "the other side".
>
> DDOS filtering is a feature, not a requirement.
>

<boggle>
Sorry, no....

Now I remember why I got fed up with the previous EH discussions
(draft-taylor-v6ops-fragdrop, draft-bonica-6man-frag-deprecate,
draft-wkumari-6man-long-headers, etc) and stopped following v6ops and
6man.
'parently not much has changed....

W

> If you want to offer that as a feature, please stop complaining that
> customers should expect that it runs at rate with packets that conform
> to existing standards.
>
>> From a purely academic point of view, I totally agree with you.
>>
>> Unfortunately, the Internet is not.
>
> The Internet is also not designed to optimize your profit margins either.
>
> Joe
>
> _______________________________________________
> v6ops mailing list
> v6ops@ietf.org
> https://www.ietf.org/mailman/listinfo/v6ops

-- 
I don't think the execution is relevant when it was obviously a bad
idea in the first place.
This is like putting rabid weasels in your pants, and later expressing
regret at having chosen those particular rabid weasels and that pair
of pants.
   ---maf