Subject: Re: DoS and anycast

From: Masataka Ohta <[email-masked]>
Date: Wed, 30 Oct 2002 09:12:59 +0859 ()

Bill;

>     > anycast will not prevent DoS attacks.
> 
> Correct.  It will merely sink attacks at the nearest instance.

It is effective protection (perhaps, the only effective protection)
against DDoS.

Once it is recognized by attackers, there will be no further DoS that
DoS attacks are prevented.

> This is
> not particularly useful until there are a _lot_ of instances.

Note that my scheme allows for millions of instances.

> For
> instance, if every major carrier ran instances near their customer edges,
> then all attacks would be sunk before they left any of those carriers, or
> before they even affected those carrier's internal backbones.  That would
> be ideal, since it would localize the pain in the same locality as the
> fault.

First, running anycast root servers is still a protection from
inter-carrier DDoS.

Second, note that not only carriers but also customers can run their
own root servers.

Then, customers are protected from DoS attack on carriers' root servers.

Carriers are protected from DoS attack on customers' root servers.

> However, we're presumably quite a long ways away from being there.

We are already here.

							Masataka Ohta
#----------------------------------------------------------------------
# To unsubscripbe, send a message to <[email-masked]>.

---

From: Masataka Ohta <[email-masked]>
Date: Wed, 30 Oct 2002 09:57:21 +0859 ()

Ted Hardie;

> > Isn't prevention of DoS attack on root servers a good enough reason
> > to deploy anycast?
> > 
> > 							Masataka Ohta
> 
> No.
> 
> Deploying anycast services (outside the RFC-1930 compliant methods
> currently in use) lessens the effect of a DoS attack, but at the cost
> of risking the integrity of the data provided by the service.

As I pointed it out several times already, anycast root servers
is the protection from forged route that the risk of getting
forged data is reduced.

> Once
> the data is adequately protected against that risk,

What is the current protection against the forged data?

Today, it is so easy to forge route  to root servers and the data.

							Masataka Ohta