Re: SYN flood messages flooding my mailbox

[Vadim Antonov <avg () quake net>]

rwoundy () VNET IBM COM wrote:

> where bitmask has a bit per every interfaces, so the bit if set if
> packet matching the prefix is allowed from that interface.

> How do you handle the case of an inter-exchange point, with multiple
> BGP neighbors per interface?  The MAE-East NAP is the worst case
> (and not everyone at a NAP is a "transit AS").

I don't propose using that at exchange points or anywhere within
backbones, for that matter.  This is for filering on edges _only_.

> What do you do with a prefix announced through two providers, where
> the prefix is taken from one provider's supernet?  Wouldn't you need
> to check the RIB entries of all matching prefixes (including default)?

See before.

You just don't do that where you have interesting routing. Fortunately,
routing on customer tail links (and in IGP-only networks) is not
"interesting" in 99.99% of cases.

--vadim

- - - - - - - - - - - - - - - - -