Blackholes and IXs and Completing the Attack.

Mon Feb 4 03:02:33 UTC 2008

On Feb 3, 2008 5:18 PM, Ben Butler <ben.butler at c2internet.net> wrote:
>
> Hi,
>
> <snip>
> "your point here is that perhaps instead of this scheme one would just
> advertise the max-prefix-length (/24 currently) from a 'better' place on
> your network and suck all the 'bad' traffic (all traffic in point of
> fact) for the attacked destination via a transit/peer/place which can
> deal with it properly?
>
> This isn't a bad solution, and it gives you some control on the traffic
> stream, it does have the penalty to everyone else of 'one more route in
> the RIB/FIB'... which I think was Ben's vote against this method. (also
> not a bad vote...)"
> </snip>
>
> Personally, I would achieve this using multiple sinkholes at the edge in
> IGP rather than advertising an extra /24 in BGP to suck it to one
> router.
>

Oops, I think I wasn't clear, my point was you could force traffic off
of most peers and transits and onto a single transit by advertising
the most specific global route possible (/24 today) through a single
transit. This way you can force all of the world to find your attacked
host through a place you choose, rather than 'everywhere'.

Shifting around things in your IGP isn't going to help the
rest-of-the-worlds view of your problem... My proposal would allow you
to normalize traffic on your peer/transit links save one (or a smaller
selection of them)...

You could extend this to pulling the /24 down some sacrificial link
(t1 sort of thing)  as well, of course. You could also reverse the
logic and either drop the route toward peers or extend the path via
as-prepend...

> I fully accept there is no single silver bullet for all situations and
> circumstances, but equally a tactic should be as effective as possible
> when it is selected and deployed - which started this thread.  And I am
> trying to advocate being able to extend completing the attack beyond
> just transit feeds that is all.

Sure, and as I and Barry said, there have been several iterations of
this discussion, not that that's a bad thing just a note that this is
ground covered at least a few times.

> I don't know about other people our multiple Internet Exchange peak
> interconnect capacity versus our transit peak capacity is a significant
> %.  While effectively securing my AS as a whole against the sources that
> reach me via transit, currently I cant do the same trick with XPs.  Now

sure you can, just don't have the traffic arrive there, draw it
elsewhere, somewhere you are better prepared to deal with the
problem... Something about fighting battles on your terms not theirs?

> traffic - that the only thing I can sensibly do to resolve the situation
> is to temporally admin down / remove my prefix announcement from the IX
> peerings to shift the load to transit.  This also doesn't seem very
> sensible.

I'd couch this in the following terms:

"Don't be where the flood is, or deal with it where you are best
equipped to..."

There are many option, getting 'peer' folks to do BHR things for you
isn't simple (most times they don't want you traffic engineering
inside their network...), getting a transit to is another story, most
times they have this facility it's just a matter of finding someone
inside their support crew to get you the right bits/setup.

Extra BGP sessions and unbounded /32 growth doesn't bode well for this
plan either... anyway, it'll be interesting to watch the discussion
progress.

-Chris