Merit Network
Can't find what you're looking for? Search the Mail Archives.
  About Merit   Services   Network   Resources & Support   Network Research   News   Events   Home

Discussion Communities: Merit Network Email List Archives

North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: engineering --> ddos and flooding

  • From: Mark Mentovai
  • Date: Mon Jun 04 14:42:40 2001

Paul Johnson wrote:
>To that end no NSP should ever allow spoofed IP addresses outside of
>their network. (not just RFC 1918 addresses but valid IPs that don't
>belong to that NSP)

Agreed, RFC 2827 should be the norm.  Maybe some day it will be.

>> This is a stop gap measure for customer networks.  Those null routed
>> /32s are not meant to be permanently advertised, they are meant to
>> free the customer's pipe from smurf/fraggle until the SP can do
>> something about it.  What would be the point of permanently
>> blackholing a host on your network?
>
>One more problem...what if your mail/web server is the target of the
>attack you have just taken that resource effectively off-line. No need
>to continue the DoS you've done the work of the attacker.

You've got to balance how badly the attack hurts against how badly this
method of stopping the attack hurts.  If someone launches a distributed
attack against my mail server, and it eats up all of the bandwidth I've
bought from my upstreams, then I've got zero connectivity.  You can be sure
I'd be in favor of taking my mail service offline to keep the rest of the
network running while I pursue the issue with the upstreams.  Ditto if
someone launches a massive attack against one of my customers and it has the
unfortunate side effect of destroying my connectivity (and that of all of my
other customers.)  A filter of this type is never a long-term solution, but
if it can get me even partially online, that's better than nothing.

Mark





Discussion Communities


About Merit | Services | Network | Resources & Support | Network Research
News | Events | Contact | Site Map | Merit Network Home


Merit Network, Inc.