Re: [v6ops] WG Doc? draft-gont-v6ops-ipv6-ehs-packet-drops

[Nick Hilliard <[e-mail]>]

[e-mail] wrote:
> no, I'm talking about behaviour just in the data plane (in my case
> one that runs entirely in software).
> if the requirement is to look into the L4 header, then there will be
> a performance penalty for processing packets with extension headers.
> looking deeper into packets == more memory accesses.
> long EHs could be used as a DOS attack against the router.

It's not viable to run high end networks on general purpose CPUs using
software forwarding.  At the very least, you need NPUs if not custom
hardware (asics, "merchant silicon", etc).

> simple solution is to not look into the L4 obviously.

That isn't a viable workaround.  Losing visibility of L4 information is
catastrophic from the point of view of ddos management.

> why wouldn't the ddos flowspec description include the EHs in that
> case and not depend on only the L4 information.

Because if you have full control of a compromised device, you can create
random EH chains on an ipv6 packet?

> can we conclude that we don't know enough about ddos attacks to
> determine how they can be filtered?

Not sure what you mean here.  People initiating DDoS attacks will do
anything if they think it will cause damage to the recipient host.  Does
that answer your question?

Nick