Force10 Gear

Sun Sep 7 17:00:26 UTC 2008

On 9/7/08 8:49 AM, Adrian Chadd wrote:
> On Sun, Sep 07, 2008, David Newman wrote:
> 
>> 1. Set IP options. A pair of Cat 6509Es using VSS can forward packets
>> without options at up to 770 mpps, but when packets have options the
>> maximum is more like 20 kpps. And that's a "high-speed" example; the
>> options forwarding rate is more like 0 pps with some other devices.
>> Silicon that forwards packets very fast is only good when header lengths
>> are fixed.
> 
> So what you're saying is "send the right crafted packets and DoS the internet",
> right?

My experience *in lab testing* is that most and perhaps all switches do
slow-path processing of v4 and v6 packets with IP options set, and that
slow-path forwarding rates are a tiny fraction of fast-path forwarding
rates. Christian Huitema made a similar observation in one of his
textbooks 10 or more years ago; tests as recently as this year suggest
this is still the case.

I'm not making any assertions about DoS attacks on production networks.
Rate controls and other mechanisms can help mitigate the effects of
flooding attacks, but that's a different topic.

> (I think I know which options may make routers go all software-path on the
> packets but I haven't given it a run on a Cat6500. Hm, I wonder if this here
> 3750 in the lab will do..)

The record route option will cause rather precipitous drops in
forwarding rates on both boxes (and many others). I have not tried other
option types, but other testers have told me these too will be slow-pathed.

Again, from the ASIC/NP/FPGA's standpoint: Fixed-length, good.
Variable-length, not so much...

dn