Re: [v6ops] WG Doc? draft-gont-v6ops-ipv6-ehs-packet-drops

[[e-mail]]

Warren,

[...]

> Yup. Ubiquitous flow labels will solve *one* of the issues with long header chains, but in the remaining cases (my personal bugbear is filtering (for dos and ingress / edge filters)) the hardware still need to be capable of doing it (at line-rate).

I never understood from the draft what the other use cases were, but those are the ones? ingress/edge filters and DOS attacks?

from the perspective of a software forwarding path.
parsing the extension header chain is _always_ going to be slower than not doing it. that in itself can be considered opening your implementation up to DOS attacks, but oh well.

can ingress / edge filters be done in two stages? core routers only filter on SA/DA while whatever infrastructure function you need to reach apply deeper filters?

for DOS attacks, are those filters put in place dynamically? what does a typical attack look like? can you identify it without having to parse EHs? how often are you not able to identify it even when looking deep? any papers/reports on this?

Best regards,
Ole

PS: In BA we're trying to do a project on VPP for the IETF hackathon, if anyone is interested in implementing EH filtering / parsing and measure the performance impact on that, it would be very welcome. (VPP is a open source high performance software data plane running on commodity hardware.)