[102253] in North American Network Operators' Group
RE: Blackholes and IXs and Completing the Attack.
daemon@ATHENA.MIT.EDU (Ben Butler)
Sat Feb 2 17:48:49 2008
Date: Sat, 2 Feb 2008 22:40:56 -0000
From: "Ben Butler" <ben.butler@c2internet.net>
To: <nanog@merit.edu>
Errors-To: owner-nanog@merit.edu
Hi,
"i explained why this is bad -- it lowers the attacker's costs in what
amounts to an economics war. they can get a web site taken down by its
own provider just by attacking it. they need fewer resources for their
attack once they know the provider's going to blackhole the victim."
I thought the cold war nuclear arms race had shown up to be truly MAD.
Who is paying for this ever escalating capacity of infrastructure as a
way to survive large DoS attacks.
Smaller attacks can be absorbed, but I really cant see a strategy of
endlessly upgrading network router and WAN infrastructure to ensure
enough head room ideal capacity is a particularly economically sensible
approach to the problem.
Ben
-----Original Message-----
From: vixie@vix.com [mailto:vixie@vix.com] On Behalf Of Paul Vixie
Sent: 02 February 2008 21:37
To: Ben Butler
Cc: nanog@merit.edu
Subject: Re: Blackholes and IXs and Completing the Attack.=20
> I was not proposing he Null routing of the attack source in the other=20
> ISPs network but the destination in my network being Null routed as a=20
> destination from your network out.
i explained why this is bad -- it lowers the attacker's costs in what
amounts to an economics war. they can get a web site taken down by its
own provider just by attacking it. they need fewer resources for their
attack once they know the provider's going to blackhole the victim.
> This has no danger to the other network as it is my network that is=20
> going to be my IP space that is blackholed in your network, and the=20
> space blackholed is going to be an address that is being knocked of=20
> the air anyway under DoS and we are trying to minimise collateral
damage.
your collateral damage is of precious little interest to someone else's
backbone staff, unless they can route-filter the potential announcements
so that you are unable to also remotely blackhole addresses you don't
advertise. i explained this as an insurance/ISO9000 problem.
> I think you might have thought I was suggesting we blackhole sources=20
> in other peoples networks - this is definatly not what I was saying.
i explained why this would be a more sensible approach, but STILL
unworkable.
> So, given we all now understand each other - why is no one doing the
above?
now that we've rehashed what we both said, i think we're done here.
