Re: [arin-announce] IPv4 Address Space (fwd)

[Alex Yuriev <alex () yuriev com>]

> On Wed, 29 Oct 2003, Alex Yuriev wrote:
> > As the network operators, we move bits and that is what we should stick to
> > moving. 
> >
> > We do not look into packets and see "oh look, this to me looks like an evil
> > application traffic", and we should not do that. It should not be the goal
> > of IS to enforce the policy for the traffic that passes through it. That
> > type of enforcement should be left to ES.
>
> Well, that is nice thery, but I'd like to see how you react to 2Gb DoS 
> attack and if you really intend to put filters at the edge or would not 
> prefer to do it at the entrance to your network. Slammer virus is just 
> like DoS, that is why many are filtering it at the highiest possible 
> level as well as at all points where traffic comes in from the customers.

Actually, no, it is not theory. 

When you are slammed with N gigabits/sec of traffic hitting your network, if
you do not have enough capacity to deal with the attack, no amount of
filtering will help you, since by the time you apply a filter it is already
too late - the incoming lines have no place for "non-evil" packets.

Leave content filtering to the ES, and *force* ES to filter the content.

Let IS be busy moving bits.

Alex