Hi, On Sat, Dec 28, 2013 at 11:00:03AM -0800, MIke wrote: > >Using any QoS mechanism, let alone an old, obsolete, unmaintained one like > >CAR, to deal with DDoS isn't a good idea - programmatically-generated > >attack traffic can 'crowd out' legitimate traffic. > > I am reasonably sure that for this one application - dropping floods of > dns traffic - is a reasonable step.
Just want to say that I like this approach. Keep the Internet access
generally open, and only in case of "emergency" rate-limit what comes
in. In that case, yes, legitimate queries will suffer, but that is
still better than "always block that type of packet". IMHO.
(I might be a bit extreme on this, but I highly value the end-to-end
communication nature of the Internet, even if 99% of the subscribers
really do not make use of it, and see the Internet as some sort of
modern TV station. But still, I'm going to fight for a transparent
end-to-end Internet - which, just to state the obvious, does *not*
include the right for anyone to send attack traffic, and indeed,
ensuring the latter doesn't kill the former is not trivial)
gert
--
USENET is *not* the non-clickable part of WWW!
//www.muc.de/~gert/
Gert Doering - Munich, Germany [email protected]
fax: +49-89-35655025 [email protected]
pgpBM7ytIuGlm.pgp
Description: PGP signature
_______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
