[84625] in North American Network Operators' Group
Re: PBR needing to hit the cpu?
daemon@ATHENA.MIT.EDU (Tony Li)
Sun Sep 18 02:40:50 2005
In-Reply-To: <FCD26398C5EDE746BFC47F43EA52A17301346701@dino.int.hostasaurus.com>
Cc: <nanog@merit.edu>
From: Tony Li <tony.li@tony.li>
Date: Sat, 17 Sep 2005 23:40:20 -0700
To: David Hubbard <dhubbard@dino.hostasaurus.com>
Errors-To: owner-nanog@merit.edu
On Sep 17, 2005, at 8:57 PM, David Hubbard wrote:
> Just curious, do most vendors' hardware need to hit the
> cpu when doing policy-based routing? I found one of my
> border routers' cpu's on the bad end of a DDoS but once
> I turned off a not necessarily required setup to force
> some outbound traffic to take a specific outbound link
> via PBR, the DDoS traffic was no longer an issue. It was
> only about 200 Mbit so I hadn't expected it to be an issue
> but apparently it was; I was surprised when support told
> me the PBR was making traffic hit the cpu.
That's not at all surprising. PBR would be pretty hard to push into
a hardware forwarding path.
Not impossible, but certainly challenging.
Tony
