Merit Network
Can't find what you're looking for? Search the Mail Archives.
  About Merit   Services   Network   Resources & Support   Network Research   News   Events   Home

Discussion Communities: Merit Network Email List Archives

North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: Yahoo! Lessons Learned

  • From: Vijay Gill
  • Date: Thu Feb 10 16:28:38 2000

On Thu, 10 Feb 2000, NANOG Mailing List wrote:

>> WEB wrote:
> > packet trace on routers passing giabits of traffic every second
> > without killing the router/network and actually get usefull
> > information out of it?

> You bridge another device in line and have THAT device collect your data.
> Not as trivial for OCx connected routers but still possible.
> 
> John Fraizer

Any monetary considerations applied to this or not?  OC-192c line cards
cost money.  The trivial answer is that DDoS attacks cost money as well,
but there is a cost/benefit analysis to be done here.  Would that money be
better spent elsewhere? 

At OC-192c for typical streams and a large sized network, the data
collection alone becomes a nearly insurmountable issue. 

Think 48 or more 192c's in a hub, think 100 hubs.  Assuming you can throw
out the non customer links, you're still around 2400 or so bridged
OC-192c's, with data polling/netflow type stats. 

Not a pretty picture.

Of course, given that we can get netflow type packet histories, plotting
the src/dest pairs for a while and then if there is a _large_ change (some
n std dev) from the norm for some particular dst (nominally the one under
attack), and then raising an alarm on that router/pipe, would make it
trivial to trace these type of attacks.  With history storage, it would
make it easier to trace back after the fact. 

The problem is, the amount of data storage.

I think it was Dr. Li who said "you can move the bits or you can count the
bits"


/vijay







Discussion Communities


About Merit | Services | Network | Resources & Support | Network Research
News | Events | Contact | Site Map | Merit Network Home


Merit Network, Inc.