[4270] in North American Network Operators' Group

home help back first fref pref prev next nref lref last post

Re[4]: SYN floods (was: does history repeat itself?)

daemon@ATHENA.MIT.EDU (Pat Calhoun)
Tue Sep 10 14:57:01 1996

Date: Tue, 10 Sep 1996 13:21:45 -0500
From: pcalhoun@usr.com (Pat Calhoun)
To: chuckie@panix.com (Alec H. Peterson), Alexis Rosen <alexis@panix.com>
Cc: nanog@merit.edu, perry@piermont.com

     Alexis,
     
        However if you are filtering on your outbound router to the net, 
     there is still the possbility that a malicious user could spoof 
     addresses as long as they belong to your address space. By moving the 
     filter out to the edge (when you have the equipment) this eliminates 
     that problem as well.
     
     Pat R. Calhoun                                e-mail: pcalhoun@usr.com 
     Project Engineer - Lan Access R&D                phone: (847) 933-5181 
     US Robotics Access Corp.
     
______________________________ Reply Separator _________________________________
Subject: Re: Re[2]: SYN floods (was: does history repeat itself?)
Author:  Alexis Rosen <alexis@panix.com> at Internet 
Date:    9/10/96 2:07 PM
     
     
Alec H. Peterson writes:
> 
> Pat Calhoun writes:
> >        This is actually quite simple to implement on Dial Access Routers, 
> >     and obviously this is the best place to add the filtering. 
> 
> Sure, that's a place to start.  Except for a few problems: 
> 
> 1) The people doing this are not necessarily using a dialup IP 
>    connection.
     
True. That's why you need to filter upstream of public-access unix boxes 
(like our own).
     
> 2) Many of us don't have dial access routers that can handle this.
     
Also true. As I said before, I don't know about the Ascends, but I do know 
that the Xylogics boxes we use have the capability but probably not the 
capacity. When all ports are connected at 28.8, CPU usage can hover in
the high 80% range. Adding filters would probably be a bad idea.
     
That's why I was talking about filtering at a router just upstream from 
the dial-access box.
     
FWIW, even with a thousand very busy modems, I'm pretty sure that even a 
small cisco is up to the job. They just don't generate all that much traffic.
     
/a

home help back first fref pref prev next nref lref last post