<html><head><style id="axi-htmleditor-style" type="text/css">p { margin: 0px; }</style></head><body dir="" style="font-size: 10pt; font-family: "Source Sans Pro", sans-serif; background-image: none; background-repeat: repeat; background-attachment: fixed;"><span style="font-size: 13.3333px;">Load balancing is done on Layer 4 or Layer 3 when routing, so your ingress connection will have the same hash as the outgoing connection (unless the source port of the connection changes on the ACK - which it really should not).</span><br><!--axi-signature_placeholder--><br>On Mon, 08/19/2019 06:18 PM, Töma Gavrichenkov <ximaera@gmail.com> wrote:<br><blockquote style="margin-left: 10px; padding-left: 10px; border-left: 1px solid #ccc;"><div dir="auto"><div><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Aug 19, 2019, 8:57 PM Valdis Klētnieks <<a href="mailto:valdis.kletnieks@vt.edu" rel="noreferrer">valdis.kletnieks@vt.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On Mon, 19 Aug 2019 20:44:47 +0300, Töma Gavrichenkov said:<br>
<br>
> Not in a typical DC/ISP environment! With the solution you propose, a<br>
> perfect routing symmetry is a hard requirement, b/c you need to make<br>
> sure a returning SYN/ACK hits the very same machine as the initial<br>
> SYN.<br>
<br>
If your load balancer isn't doing something to make that situation work properly,<br>
you need to talk to your vendor.<br></blockquote></div></div><div dir="auto"><br></div><div dir="auto">If you're doing load balancing for *outgoing* traffic — and in exactly the same manner as you do with incoming — then maybe.</div><div dir="auto"><br></div><div dir="auto">This also assumes that instead of mitigating an attack near the border you set up and keep an internal cluster of filtering machines somewhere and route, in the worst case scenario, *all* of your traffic through that cluster. Depending on the size of your network, it might or might not be an effective solution.</div><div dir="auto"><br></div><div dir="auto">--</div><div dir="auto">Töma</div><div dir="auto"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
</blockquote></div></div></div>
</blockquote></body></html>