Effective ways to deal with DDoS attacks?

Iljitsch van Beijnum iljitsch at muada.com
Thu May 2 16:58:06 UTC 2002


On Thu, 2 May 2002, LeBlanc, Jason wrote:

> There are some limitations as to where uRPF works, SONET only on GSRs for
> example (thanks Cisco).  I believe it will work on 65xx (SUP1A and SUP2 I
> think) regardless of interface type.  Impact should be minimal, as it simply
> does a lookup in the CEF table, if the route isn't there it discards.

It can do much more. You can use it to get rid spoofed source addresses
from customers and peers without the need to maintain large access lists.

> lookup, much more efficient than a filter.  This will get rid of a HUGE
> percentage of spoofed packets that hit your network,

If you just filter out anything that's not in the routing table, that's
about half the address space and it only works if the spoofers are stupid.
When you're looking at pure bandwidth that's still helpful, but it doesn't
really solve anything.

However, You can use unicast RPF as a very efficient source address
filter, by routing addresses to the null interface. This way you can get
rid of huge amounts of unwanted sources in a very clean way.

As long as we're asking for features: what I would like is a unicast RPF
check that allows everything that isn't routed to the null interface. And
of course unicast RPF period for all vendors who aren't Cisco.




More information about the NANOG mailing list