Subject: RE: [Ieprep] Understanding Congestion

From: "King, Kimberly S." <[email-masked]>
Date: Tue, 17 Dec 2002 10:32:27 -0500

> 
>       Kimberly King quotes Steve Bellovin:
>     > Congestion management in the Internet is problematic, 
> in part, because no
>     > capabilities exist for managing traffic associated with 
> specific users,
>     > connections, sources, or destinations, and it would be 
> difficult to
>     > implement such capabilities.
> 
> While the former was true at the time Steve wrote this in 
> 1998, it is no
> longer so.  The latter, that it was difficult to implement, was
> demonstrated to be true.  :-)
> 
> The fix was the combination of uRPF, real-time backscatter 
> analysis, and
> the use of iBGP to distribute blackhole sources/destinations 
> within the
> backbone.
> 
> The limitation is the same as that of any kind of tagging: 
> you can't trust
> such information entering from outside the AS, since it's a DoS attack
> rather than valid.

I understand your point here but just to be clear, 
prohibiting denial of service attacks that
are based on forged source addresses and doing it in a
scaleable accurate way against address aggregates
is a different problem than congestion management of
individual flows or user sessions.

The case that has been worked on is illegitimate bulk
traffic at layer 3... legitimate traffic from customers
at the session layer seems to be a completely different
problem to me...

Kimberly

Disclaimer:  My statements represent my own thinking and do not necessarily 
reflect the position of anyone else in the world including my employer. 
_______________________________________________
Ieprep mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ieprep

---

From: Bill Woodcock <[email-masked]>
Date: Tue, 17 Dec 2002 13:20:58 -0800 (PST)

> individual flows or user sessions.

Right...  The combination of uRPF, backscatter, and iBGP is used to sink
traffic to a destination /32, regardless of source address.

                                -Bill