cb.list6 at gmail.com
Thu Dec 19 16:33:21 UTC 2013
On Thu, Dec 19, 2013 at 8:18 AM, Edward Lewis <ed.lewis at neustar.biz> wrote:
> On Dec 18, 2013, at 18:12, cb.list6 wrote:
> > I am strongly considering having my upstreams to simply rate limit ipv4
> > UDP. It is the simplest solution that is proactive.
> Recently it's been said that when a protocol is "query/response" (like
> DNS), willingly suppressing responses might be as harmful as passing all
> the traffic.
> This comes from a presentation at October's DNS-OARC workshop:
> This is a "what is possible in theory" presentation, said to help you set
> your expectation whether this is a true threat or not.
> The underlying message is that while a querier is waiting for a response,
> there is a window of vulnerability in which a forged response might be
> accepted. If the responder elects not to respond, they increase the (time)
> duration of that window.
> While "smart" rate limiting exhibits benefits I suspect "simple" rate
> limiting might have some undesirable consequences.
I completely agree. This why i have not yet implemented IPv4 UDP
rate-limiting yet, but it seems inevitable for 2014 if these attacks go on.
The profile i have in mind is when UDP exceeds 5x the baseline, then
Keep in mind, when UDP exceeds 5x the baseline, the chances are are 99%
that the UDP is consuming the entire ISP pipe and everything is
rate-limited due to the pipe being saturated. So, this is not a simple
either / or. This is degrade UDP proactively or suffer all traffic
degrading because there is a huge DDoS coming in (which is the current
> Edward Lewis
> NeuStar You can leave a voice message at
> Why is it that people who fear government monitoring of social media are
> surprised to learn that I avoid contributing to social media?
More information about the NANOG