[74817] in North American Network Operators' Group
Re: aggregation & table entries
daemon@ATHENA.MIT.EDU (Patrick W Gilmore)
Thu Oct 14 16:35:25 2004
In-Reply-To: <20041014202757.GA26087@srv01.cluenet.de>
Cc: Patrick W Gilmore <patrick@ianai.net>
From: Patrick W Gilmore <patrick@ianai.net>
Date: Thu, 14 Oct 2004 16:34:28 -0400
To: nanog@merit.edu
Errors-To: owner-nanog-outgoing@merit.edu
On Oct 14, 2004, at 4:27 PM, Daniel Roesen wrote:
>> Yes, these restrictions are a huge pain in the rear end but a denial
>> of
>> service without even the possibility to tell where the packets come
>> from is MUCH worse.
>
> What you actually want to know is what the ingress interfaces for the
> flows are. And if the ingress interface is not a p2p interface, from
> which peer. For both problems quite effective solutions do exist
> (ok, not really for the latter, but this is highly vendor specific).
No, what I really want to know is the source IP.
> Given that most DDoSses are mounted via huge zombie collections, there
> is not much point in knowing the real source IPs.
Didn't we cover this?
Yes, there are zombie armies launching DDoS from "real" IP addresses.
But that does not mean there are no spoofed-source attacks any more.
--
TTFN,
patrick
