[146946] in North American Network Operators' Group
Re: IPv6 prefixes longer then /64: are they possible in DOCSIS
daemon@ATHENA.MIT.EDU (Valdis.Kletnieks@vt.edu)
Tue Nov 29 01:44:35 2011
To: Jeff Wheeler <jsw@inconcepts.biz>
In-Reply-To: Your message of "Tue, 29 Nov 2011 00:15:02 EST."
<CAPWAtbLbsj8Pd3aWgSaC-SBkfd41Naw1wLcHpJ5DgN_P6V3f4A@mail.gmail.com>
From: Valdis.Kletnieks@vt.edu
Date: Tue, 29 Nov 2011 01:43:04 -0500
Cc: nanog@nanog.org
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
--==_Exmh_1322548984_6108P
Content-Type: text/plain; charset=us-ascii
On Tue, 29 Nov 2011 00:15:02 EST, Jeff Wheeler said:
> Owen and I have discussed this in great detail off-list. Nearly every
> time this topic comes up, he posts in public that neighbor table
> exhaustion is a non-issue. I thought I'd mention that his plan for
> handling neighbor table attacks against his networks is whack-a-mole.
> That's right, wait for customer services to break, then have NOC guys
> attempt to clear tables, filter traffic, or disable services; and
> repeat that if the attacker is determined or going after his network
> rather than one of his downstream customers.
It's worked for us since 1997. We've had bigger problems with IPv4 worms that
decided to probe in multicast address space for their next target, causing CPU
exhaustion on routers as they try to set up zillions of multicast groups.
Sure, it's a consideration. But how many sites are *actually* getting hit
with this, compared to all the *other* DDOS stuff that's going on? I'm willing
to bet a large pizza with everything but anchovies that out in the *real*
world, 50-75 times as many (if not more) sites are getting hit with IPv4
DDoS attacks that they weren't prepared for than are seeing this one
particular neighbor table exhaustion attack.
Any of the guys with actual DDoS numbers want to weigh in?
--==_Exmh_1322548984_6108P
Content-Type: application/pgp-signature
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Exmh version 2.5 07/13/2001
iD8DBQFO1H74cC3lWbTT17ARAjuqAKC//EnqZmCY15jCJgVR3R0wDw+cqgCbBxtv
KLJpBi9KEYophOhv4C42Qrs=
=oeMg
-----END PGP SIGNATURE-----
--==_Exmh_1322548984_6108P--
