[68245] in North American Network Operators' Group
Re: UUNet Offer New Protection Against DDoS
daemon@ATHENA.MIT.EDU (Alex Bligh)
Sat Mar 6 20:23:08 2004
Date: Sun, 07 Mar 2004 01:22:31 +0000
From: Alex Bligh <alex@alex.org.uk>
Reply-To: Alex Bligh <alex@alex.org.uk>
To: Paul Vixie <vixie@vix.com>, nanog@merit.edu
Cc: Alex Bligh <alex@alex.org.uk>
In-Reply-To: <g37jxxpoio.fsf@sa.vix.com>
Errors-To: owner-nanog-outgoing@merit.edu
--On 06 March 2004 23:02 +0000 Paul Vixie <vixie@vix.com> wrote:
> ok, i'll bite. why do we still do this? see the following from June
> 2001:
>
> http://www.cctec.com/maillists/nanog/historical/0106/msg00681.html
Having had almost exactly that phrase in my peering contracts for
$n years, the answer is because if you are A, and peer is B,
if ( A>B )
your spoofed traffic comes (statistically) from elsewhere so you don't
notice. You are dealing with traffic from C, where C>>A
else
you've signed their peering agreement, and are 'peering' on their
terms instead. Was I going to pull peering with $tier1 from whom
the occasional DoS came? Nope.
The only way this was ever going to work was if the largest networks
cascaded the requirements down to the smallest. And the largest networks
were the ones for whom (quite understandably) rpf was most difficult.
DoS (read unpaid for, unwanted traffic) is one of the best arguments
against settlement-free peering (FX: ducks & runs).
Alex
