Re: SYN flood messages flooding my mailbox

[Curtis Villamizar <curtis () ans net>]

In message <199609180045.RAA00207 () quest quake net>, Vadim Antonov writes:
> Curtis Villamizar <curtis () ans net> wrote:
>
> > > If you relax criteria for reverse-route filtering to "known route" instead
> > > of "best route" then any customer (non-transit) AS can be filtered safely
> > > at border routers.
>
> > And if the "known route" is know by another router but suppressed from
> > IBGP advertisement because there is a better route ..
>
> But you still have the exterior route in the RIB.  So you know it.

I guess a picture would help:

     AS X R1  ------  AS Y R3
        |                |
        |                |
     AS X R2  ------  AS Y R4

If the route learned at AS Y R4 is preferred, AS Y R3 may get packets
although the forwarding entry (Fib) points toward AS Y R4, the LocRib
does not contain the entry (no preferred), only the AdjRibIn contains
the entry.  If the filter must be set according to AdjRibIn, you now
have a filter list **in the forwarding path** considerably longer than
the current routing table.  Won't scale at the very least.

> > Or if the "known route" goes through an AS that uses YOU as their best
> > route but the reverse traffic goes a different way..
>
> So what?  The assumption is that multi-homed AS announces all its
> routes to all exits (maybe with different "metrics").

In this case:

     AS a R1  ------  AS b R2  ------  AS d R4
        |                |                |
        |                |                |
        +-----------  AS c R3  -----------+

In this case AS c prefers AS a.  AS d prefers AS c.  AS b prefers the
routes it hears from AS b.  AS a prefers some route through AS d that
it hears from AS b over the route it hears from AS c.  Therefore AS d
has no Fib, LocRib, or even AdjRibIn from AS b R2, but will get
legitimate traffic from R2 that is dstined for places that is
reachable through AS d but for which AS d uses AS c for the return path.

> Is there any practical example of _properly configured_ multihomed
> non-transit AS which advertises more routes at one exit than another?
>
> > Both of these cases and other cause a blackhole.
>
> Not at all.

The first case is clearly less scalable than the current routing table
(consider putting all AdjRibIn entries at a NAP into your filters on
the forwarding card).  The second just plain doesn't work.

Curtis
- - - - - - - - - - - - - - - - -