Re: [v6ops] new draft: draft-taylor-v6ops-fragdrop

[Warren Kumari <[e-mail]>]

On Oct 18, 2012, at 6:31 PM, Mark Andrews <[e-mail]> wrote:

> 
> repl: bad addresses:
> 	C. M. Heard <[e-mail]> -- no at-sign after local-part (<)
> 
> In message <[e-mail]>, Warren Kumari writes:
>> 
>> Yes, and part of the reason that packets are not reaching the core infrastr=
>> ucture at line rate is because operators have the ability to examine traffi=
>> c destined for the core infrastructure and filter / rate-limit it to someth=
>> ing reasonable. I may want to allow e.g traceroute to "core" stuff and toss=
>> that in one rate-limit bucket, but never allow SSH towards my core.  If I =
>> have fragments I have no way of knowing what they are supposed to be part o=
>> f, and so, er=85 =
> 
> So you want allow fragmented ICMP directed at core routers through and are worried
> that some non initial TCP fragments might make it through.  As far as I can tell
> letting through non initial TCP fragments doesn't increase your risk or attack
> surface at all.

Ah, sorry, I guess I was unclear --  the connection from the data plane to the control plane is much much smaller than the data plane interfaces. This means that I need to protect the CP / CP interface by classifying and filtering / policing / rate-limiting traffic before it hits the CP interface. This means that I need to be able to examine the traffic to classify it. If I get a fragment, I have no way of knowing what it is for, and so have no way of knowing which rate-limiter to apply. This means I can a: just drop it, b: guess at a classification, c: have a classifier for all fragments or d: just accept all frags.

This is part of a more general problem -- if I have a router with a 10G interface facing "the Internet"[0] and e.g a webserver connected behind it with a 1G interface I'd like to make sure that only port 80/443 traffic is vying for the limited bandwidth. As I cannot reassemble on the router, I cannot classify what non-initial fragments are to know if they should be allowed.
Yes, an attacker can (obviously) still DoS me with >1Gbps of traffic on port 80, but at least I can filter out the stupid attacks on other ports (which works surprisingly well :-P)

W 

[0]: any network filled with badness...


> Mark
> -- 
> Mark Andrews, ISC
> 1 Seymour St., Dundas Valley, NSW 2117, Australia
> PHONE: [phone]                 INTERNET: [e-mail]
> 

--
Curse the dark, or light a match. You decide, it's your dark.
                -- Valdis Kletnieks