Re: [v6ops] WG Doc? draft-gont-v6ops-ipv6-ehs-packet-drops

[[e-mail]]

Nick,

> [e-mail] wrote:
>> from the perspective of a software forwarding path. parsing the
>> extension header chain is _always_ going to be slower than not doing
>> it. that in itself can be considered opening your implementation up
>> to DOS attacks, but oh well.
> 
> assuming that you're talking about routers with separate management and
> forwarding planes, and that you're referring to packets being punted
> from the regular forwarding plane to the management plane when they are
> difficult to handle (e.g. large EH chains), you can assume that on
> current large routers, this is as good as dropping the packet because
> the disparity between the capacity of the forwarding plane and the
> management plane is too large to be useful. No-one in their right mind
> will let the management plane of a high end router chew up management
> CPU by forwarding punted packets. It's pointless.

no, I'm talking about behaviour just in the data plane (in my case one that runs entirely in software).
if the requirement is to look into the L4 header, then there will be a performance penalty for processing packets with extension headers. looking deeper into packets == more memory accesses.
long EHs could be used as a DOS attack against the router.

simple solution is to not look into the L4 obviously.

>> can ingress / edge filters be done in two stages? core routers only
>> filter on SA/DA while whatever infrastructure function you need to
>> reach apply deeper filters?
> 
> Basically, no.  What might look to be legitimate traffic on core ingress
> might only become visible as a ddos attack on the egress to the edge.
> That's assuming that there is a clear-cut edge and core which there
> often isn't.
> 
>> for DOS attacks, are those filters put in place dynamically?
> 
> yes - e.g. via flowspec.
> 
>> what does a typical attack look like?
> 
> they vary extremely widely; the smarter attacks will measure the effect
> on the recipient site and vary the ddos traffic according to what
> appears to work the best.  I.e. if one style of traffic appears not to
> be having an impact, the traffic profile might change to something else
> to see if that causes more trouble.
> 
>> can you identify it without having to parse EHs?
> 
> If someone attacks with ipv6 and there is a long enough EH chain to
> cause the normal forwarding plane of a router to be unable to look far
> enough into the packet to determine the L4 info, then the only real
> option is to drop or rate limit (which is nearly equivalent to dropping
> in the case of a ddos). There is insufficient parsing granularity on any
> current equipment to be able to do much else.

why wouldn't the ddos flowspec description include the EHs in that case and not depend on only the L4 information.

can we conclude that we don't know enough about ddos attacks to determine how they can be filtered?

cheers,
Ole