Hi,

I'm sensing a lot of frustration / anger / hatred for NLB, having never really 
used it myself I'll just back away from that quietly :)

Unfortunately the test is valid because the situation actually arose when a 
Windows NLB cluster went offline and there was a load of DDoS traffic heading 
to it. The whole reason I'm even working on this is because it 'did' happen, 
unfortunately...

However, aside from <cough> NLB, what stops a compromised device from being 
used to emit such traffic maliciously?

In the colocation world we have seen examples where the attacker just rents a 
couple of VPS instances with the same provider as their target and uses it to 
take down the target from the 'inside' by messing with the providers' 
infrastructure.

The (two lines in linux) example I was testing with would be a nice way to do 
this, at least until the provider tracks it down and pulls it. Which in itself 
could be tricky if the CPU is maxed out and/or your traffic graphing shows only 
'unicast' traffic PPS, thus is blind to multicast.

I assumed that there was just a configuration I was missing but it's now 
sounding like it's just a limitation, which is a real shame. Although it's 
partially possible with 15M it seems.

Oh well, time to move on, so thanks again for all the input everyone :) Cheers!




Robert Williams
Custodian Data Centre
Email: [email protected]
http://www.CustodianDC.com


Robert Williams
Backline / Operations Team
Custodian DataCentre
tel: +44 (0)1622 230382
email: [email protected]
http://www.custodiandc.com/disclaimer.txt

-----Original Message-----
From: [email protected] 
[mailto:[email protected]] On Behalf Of Tony Varriale
Sent: 16 December 2012 16:23
To: [email protected]
Subject: Re: [c-nsp] All multicast punting to CPU on 6500

This covers the issue well.

http://www.cisco.com/en/US/products/hw/switches/ps708/products_configuration_example09186a0080a07203.shtml

Highly recommended to stay away from MS NLB.  It's been designed poorly for 
over 7 years (that I know of personally).

I think your test is invalid.  You should come up with a real use case(s).  In 
the world of networking, most of us can come up with tests that would crush and 
boggle any box.

tv


_______________________________________________
cisco-nsp mailing list  [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

Reply via email to