Getting hit hard by CHINANET

Ca By cb.list6 at gmail.com
Mon Mar 23 14:55:31 UTC 2015


On Sun, Mar 23, 2014 at 3:43 AM, Justin M. Streiner <streiner at cluebyfour.org
> wrote:

> On Mon, 23 Mar 2015, Ca By wrote:
>
>  Having your upstream apply a permanent udp bw policer, say 5 or 10x busy
>> hour baseline, works well for this.
>>
>
> Many upstreams will not do that, particularly on a permanent basis.  They
> might do something temporarily to deal with an incident, but many of the
> bigger carriers probably wouldn't want to leave that in place permanently.
>
> jms
>

Mine Tier 1 up-streams are fine with it permanent. YMMV.  I did have to get
my account team involved, but from a technical perspective, a one line
policer (all UDP rate-limit to 10% of link speed) is not a technical
challenge, and the one-off config element is not overly burdensome.

Again, YMMV.  And, your frequency and impact of IPv4 UDP based attacks will
dictate your needs.

CB


More information about the NANOG mailing list