Merit Network
Can't find what you're looking for? Search the Mail Archives.
  About Merit   Services   Network   Resources & Support   Network Research   News   Events   Home

Discussion Communities: Merit Network Email List Archives

North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: DDoS: CAR vs TCP-Intercept vs NetFlow

  • From: Richard Steenbergen
  • Date: Mon Feb 28 21:17:58 2000

On Mon, Feb 28, 2000 at 10:53:41PM -0300, Rubens Kuhl Jr. wrote:
> Have anyone performed an evalution of rate-limiting SYN packets (CAR) versus
> using TCP-Intercept ? What responds better to a DDoS attack (assume
> SYN-flooding only) ? What uses more router resources ?

TCP Intercept uses much more, but the concept of TCP Intercept is to
enable the server to continue accepting new connections, while CAR against
SYNs will most likely impact that ability significantly.

TCP Intercept would not have been effective against these attacks (or any
other attack large enough to be a DDoS) due to the sheer number of
packets/sec involved. In reality TCP Intercept is like putting a SYN flood
tuned TCP/IP stack in front of an entire network, its useful for
protecting hosts which for whatever reason cannot handle any serious syn

Many people do not understand that there is a large factor in a SYN flood
called magnitude. The earliest generation SYN floods (PANIX fame) filled
simple connection queues and denied new connections with very low
bandwidth required by the attacker (dialup speeds). The high speed / DDoS
syn floods of today are on the order of tens or hundreds of thousands of
packets/sec, and aim to completely disable the target they are attacking
by using all available CPU in the kernel processing SYNs instead of doing
other things. Modern PC CPUs are of a much higher power (for the price)
then router CPUs, and you will probably fair much better with a p3 500 on
a good FastEthernet connection and a decent OS doing intelligent dropping.

> For better performance of CAR or TCP-Intercept, NetFlow switching (ip
> route-cache flow) should also be used, besides CEF ?

NetFlow improves performance of long access lists, it will not help CAR
(which is queue based) or TCP Intercept. CEF is your best bet.

Richard A. Steenbergen <>
PGP Key ID: 0x60AB0AD1  (E5 35 10 1D DE 7D 8C A7  09 1C 80 8B AF B9 77 BB)
MFN / AboveNet Communications Inc - Network Architect, Vienna VA

Discussion Communities

About Merit | Services | Network | Resources & Support | Network Research
News | Events | Contact | Site Map | Merit Network Home

Merit Network, Inc.