Re: [v6ops] Fwd: New Version Notification for draft-wkumari-long-headers-01.txt

[Gert Doering <[e-mail]>]

Hi,

On Fri, Jul 05, 2013 at 04:23:55PM +0200, Ray Hunter wrote:
> > ... "drop this UDP/53 flood at the most external borders we can to stop
> > it from overloading internal links".
> No disrespect, but by the time you've detected the attack and put in the
> appropriate L4 filtering config, haven't the attackers long gone?
> 
> Doesn't this sort of DoS defence need to be auto-detecting, and
> auto-responding, like fair queueing?

Well, these days people observe UDP/53 flooding that goes on for days.

Who will know what's there tomorrow?


> Or in the old days, simply reducing the link speed to untrusted peers?

All peers are untrusted - and we're not interested in reducing speed for
useful traffic.  

Assume that our external links can handle the traffic, the "bad" traffic 
is easily identified (like: UDP/53 reflective DoS to a web server who 
doesn't need any external UDP in the first place), and that some internal 
link towards the web server would become overloaded.

Being able to filter at the most external borders is a must.

(But I'm not sure this discussion is going anywhere - I'd welcome if all
people that argue that this is not a problem run an ISP network for a 
few weeks, and then come back)

Gert Doering
        -- Operator
-- 
have you enabled IPv6 on something today...?

SpaceNet AG                        Vorstand: Sebastian v. Bomhard
Joseph-Dollinger-Bogen 14          Aufsichtsratsvors.: A. Grundner-Culemann
D-80807 Muenchen                   HRB: 136055 (AG Muenchen)
Tel: [phone]            USt-IdNr.: DE813185279