Subject: RE: [Ieprep] Understanding Congestion

From: "Ayyasamy, Senthilkumar (UMKC-Student)" <[email-masked]>
Date: Mon, 16 Dec 2002 19:20:42 -0600

> > Congestion management in the Internet is problematic, in part, because no
> > capabilities exist for managing traffic associated with  specific users,
> > connections, sources, or destinations, 

In addition to Bill's list, a simple ACL is the fundamental thing for 
doing the above stuff.

> 
> The fix was the combination of uRPF, real-time backscatter 
> analysis,

and sink holes

>  and the use of iBGP to distribute blackhole sources/destinations 
> within the  backbone.

Black hole filtering will be useful layer 3 work and not layer 4. 
But that is not a major limitation.

> The limitation is the same as that of any kind of tagging: 
> you can't trust such information entering from outside the 
> AS, since it's a DoS attack  rather than valid.

yaa.. Black-hole filtering can come in handy for DoS attackers.
_______________________________________________
Ieprep mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ieprep

---

From: "Ayyasamy, Senthilkumar (UMKC-Student)" <[email-masked]>
Date: Tue, 17 Dec 2002 12:49:03 -0600

> >Kimberly King quotes Steve Bellovin:
> >> Congestion management in the Internet is problematic, 
> >> in part, because no capabilities exist for managing traffic
> >>  associated with specific users,
> >> connections, sources, or destinations, and it would be 
> >> difficult to implement such capabilities.
> > 
> > While the former was true at the time Steve wrote this in 
> > 1998, it is no longer so.  The latter, that it was 
> > difficult to implement, was demonstrated to be true.  :-)
> > 
> > analysis, and
> > the use of iBGP to distribute blackhole sources/destinations 
> > within the
> > backbone.
> > 
> > you can't trust
> > such information entering from outside the AS, since it's a 
> DoS attack
> > rather than valid.

> prohibiting denial of service attacks that
> are based on forged source addresses and doing it in a
> scaleable accurate way against address aggregates
> is a different problem 

congestion management of high bandwidth flows and aggregate 
based traffic is a challenging problem to be tackled.
RED-PD was suggested as a solution for aggregate based traffic.
You have to see Steve's work on RED-PD along with ratul
and sally floyd. 

> than congestion management of
> individual flows or user sessions. 
> The case that has been worked on is illegitimate bulk
> traffic at layer 3... legitimate traffic from customers
> at the session layer seems to be a completely different
> problem to me...

A possible way for congestion management of a legitimate  
traffic from customer can by maintaining is using a
combination of techniques mentioned by Bill.
Doesnt RFC 2914 answer such issues? Section 3.2 talks about 
fairness. Also, ecm by use of Congestion managers (RFC 3124) can 
also be helpful  if your so pariticular about specific user or 
application traffic.

But, I dont think this is a major problem. Their are many other
problems like how effectively we do congestion control for 
high bandwidth flows and the associated fairness issues.

---

From: "Nguyen, An" <[email-masked]>
Date: Thu, 26 Dec 2002 08:59:16 -0500

Bill,

-----Original Message-----
From: Bill Woodcock [mailto:[email-masked]]
Sent: Wednesday, December 25, 2002 9:23 PM
To: Nguyen, An
Cc: [email-masked]'
Subject: RE: [Ieprep] Understanding Congestion

>If you want security, write some firewall rules, like everybody else.

Actually, we use both firewall rules and NAT as needed.

Happy holidays!

An