Re: [v6ops] Fwd: New Version Notification for draft-wkumari-long-headers-01.txt

On 7/5/13 7:23 AM, Ray Hunter wrote:
>> Gert Doering <mailto:gert@space.net>
>> 5 July 2013 16:17
>> Hi,
>>
>> On Fri, Jul 05, 2013 at 04:14:44PM +0200, Ray Hunter wrote:
>>> Exactly. And the requirement from Geert and Steinar was for protecting
>>> control plane traffic AFAICS.
>> Well, actually we need both...
>>
>>> So what is the requirement to process L4 headers offorwarded traffic at
>>> 10 gbps in backbone routers?
>> ... "drop this UDP/53 flood at the most external borders we can to stop
>> it from overloading internal links".
> No disrespect, but by the time you've detected the attack and put in the
> appropriate L4 filtering config, haven't the attackers long gone?
The attempt at disruption lasts until the party achieves their goal, or 
gives up.
> Doesn't this sort of DoS defence need to be auto-detecting, and
> auto-responding, like fair queueing?
Given a detection and mitigation platform you can identify and then 
install and remove acls accordingly

http://tools.ietf.org/html/rfc5575

http://tools.ietf.org/html/draft-ietf-idr-flow-spec-v6-03

of course that requires that you be able to find the header you're 
trying to match on.

actual deployment of flowspec in the field isn't for everyone, and it 
has a lot of warts in implementations. but it's there.
> Or in the old days, simply reducing the link speed to untrusted peers?
>> Gert Doering
>>          -- NetMaster
>>
> _______________________________________________
> v6ops mailing list
> v6ops@ietf.org
> https://www.ietf.org/mailman/listinfo/v6ops
>