OK so let's try this.. If you can show me a linux router can can route
100mbps or more of juno-z.101f.c attack without dropping packets I will
be thoroughly impressed :)
I am willing to test out any code/patches and settings that you can
think of and post some results..
Paul xerox@xxxxxxxxxx http://www.httpd.net
-----Original Message-----
From: David S. Miller [mailto:davem@xxxxxxxxxx]
Sent: Monday, June 09, 2003 1:59 AM
To: xerox@xxxxxxxxxx
Cc: hadi@xxxxxxxxxxxxxxxx; sim@xxxxxxxxxxxxx; fw@xxxxxxxxxxxxx;
netdev@xxxxxxxxxxx; linux-net@xxxxxxxxxxxxxxx
Subject: Re: Route cache performance under stress
From: "CIT/Paul" <xerox@xxxxxxxxxx>
Date: Mon, 9 Jun 2003 01:27:48 -0400
Ahah Jamal!! Yes I have tried.. It does absoutely nothing for the
constant randomness of packets.
It increases the overall distribution of the hash in the cache but it
does nothing for the addition of new packets..
Try fowarding packets generated by juno-z.101f.c and it adds EVERY
packet to the route cache.. Every one. And at 30,000 pps
It destroys the cache because every single packet coming in is NOT in
the route cache because it's random ips.
So you make packets that do things like this GC the oldest
(LRU) routing cache entry.
This isn't rocket science, and well behaved flows will still get all the
benefits of the routing cache.
The only person penalized will be the attacker since his routing cache
entries will purge out quickly and as a response to HIS traffic.
Nothing you can do
No, there are many things we can do.
Prove to me that routing caches are unable to behave acceptibly in
random source address DoS situations.
(I'm not Even sure why this is necessary anyway.. Who would want to
add every single src/dst flow to a cache?
Because %99 of traffic is well behaved flows, trains of packets. Even
the most loaded core routers see flow lifetimes of at least 8 or 9
packets.
Even if the flows lasted 3 packets, the input route lookup work saved
(source address validation in particular, which requires access to a
centralized global table and thus does not scale well on SMP) is
entriely worth it.
|