misunderstanding scale

Wed Mar 26 10:18:14 UTC 2014

On Wed, Mar 26, 2014 at 6:31 AM, Owen DeLong <owen at delong.com> wrote:

> OTOH, a spammer with a single /64, pretty much the absolute minimum IPv6
> block, has more than 18 quintillion addresses and there's not a computer on
> the planet with enough memory (or probably not even enough disk space) to
> store that block list.
>

It only takes a single entry if you do not store /128s but that /64. Yes,
RBL lookups do not currently know how to handle this, but there are a
couple of good proposals around on how to do it.

This would also reduce the risks from cache depletion attacks via DNSxL
lookups to IPv4 levels.

Sometimes scale is everything. host-based reputation lists scale easily to
> 3.2 billion host addresses. IPv6, not so easily.
>

As soon as we get away from host-centric-view to a network-block-view,
things get pretty straightforward.

-- Matthias