Re: [v6ops] WG Doc? draft-gont-v6ops-ipv6-ehs-packet-drops

[Nick Hilliard <[e-mail]>]

[e-mail] wrote:
> from the perspective of a software forwarding path. parsing the 
> extension header chain is _always_ going to be slower than not doing 
> it. that in itself can be considered opening your implementation up 
> to DOS attacks, but oh well.

assuming that you're talking about routers with separate management and
forwarding planes, and that you're referring to packets being punted
from the regular forwarding plane to the management plane when they are
difficult to handle (e.g. large EH chains), you can assume that on
current large routers, this is as good as dropping the packet because
the disparity between the capacity of the forwarding plane and the
management plane is too large to be useful. No-one in their right mind
will let the management plane of a high end router chew up management
CPU by forwarding punted packets. It's pointless.

> can ingress / edge filters be done in two stages? core routers only 
> filter on SA/DA while whatever infrastructure function you need to 
> reach apply deeper filters?

Basically, no.  What might look to be legitimate traffic on core ingress
might only become visible as a ddos attack on the egress to the edge.
That's assuming that there is a clear-cut edge and core which there
often isn't.

> for DOS attacks, are those filters put in place dynamically?

yes - e.g. via flowspec.

> what does a typical attack look like?

they vary extremely widely; the smarter attacks will measure the effect
on the recipient site and vary the ddos traffic according to what
appears to work the best.  I.e. if one style of traffic appears not to
be having an impact, the traffic profile might change to something else
to see if that causes more trouble.

> can you identify it without having to parse EHs?

If someone attacks with ipv6 and there is a long enough EH chain to
cause the normal forwarding plane of a router to be unable to look far
enough into the packet to determine the L4 info, then the only real
option is to drop or rate limit (which is nearly equivalent to dropping
in the case of a ddos). There is insufficient parsing granularity on any
current equipment to be able to do much else.

> how often are you not able to identify it even when looking deep?
> any papers/reports on this?

No papers that I'm aware of.

Nick