Re: D/DoS mitigation hardware/software needed.

["Dobbins, Roland" <rdobbins () arbor net>]

On Jan 5, 2010, at 12:05 PM, Rick Ernst wrote:

> A solution preferably that integrates with NetFlow and RTBH.  An in-line solution obviously requires an appliance, or 
> at least special/additional hardware.

The key is to not be inline all the time, but only inline *when needed*.  This removes operational complexity, provides 
the ability to oversubscribe, and simplifies the routine troubleshooting matrix.

> I'm looking at taking the first whack at immediate mitigation at the border/edge (upstream) via uRPF and RTBH.  

Good plan.

> Additional mitigation would be  via manual or automatic RTBH or security/abuse@ involvement with upstreams.

Automagic is generally bad, as it can be gamed.  

-----------------------------------------------------------------------
Roland Dobbins <rdobbins () arbor net> // <http://www.arbornetworks.com>

    Injustice is relatively easy to bear; what stings is justice.

                        -- H.L. Mencken