On Tue, 29 Nov 2011 00:15:02 EST, Jeff Wheeler said: > Owen and I have discussed this in great detail off-list. Nearly every > time this topic comes up, he posts in public that neighbor table > exhaustion is a non-issue. I thought I'd mention that his plan for > handling neighbor table attacks against his networks is whack-a-mole. > That's right, wait for customer services to break, then have NOC guys > attempt to clear tables, filter traffic, or disable services; and > repeat that if the attacker is determined or going after his network > rather than one of his downstream customers.
It's worked for us since 1997. We've had bigger problems with IPv4 worms that decided to probe in multicast address space for their next target, causing CPU exhaustion on routers as they try to set up zillions of multicast groups. Sure, it's a consideration. But how many sites are *actually* getting hit with this, compared to all the *other* DDOS stuff that's going on? I'm willing to bet a large pizza with everything but anchovies that out in the *real* world, 50-75 times as many (if not more) sites are getting hit with IPv4 DDoS attacks that they weren't prepared for than are seeing this one particular neighbor table exhaustion attack. Any of the guys with actual DDoS numbers want to weigh in?
pgpywzJitsWOz.pgp
Description: PGP signature
