3 ms·

This is definitely false. The effective approach for DDOS mitigation is to anycast the attacked subnet to diffuse the attack and intercept it with firewall nod

This is definitely false. The effective approach for DDOS mitigation is to anycast the attacked subnet to diffuse the attack and intercept it with firewall nodes at the edge which use ASIC/FPGA offload to filter the attack at line rate then forward the filtered stream back to its usual edge. eBPF direct compilation to NPU instructions is already supported on Linux by some devices, which is one reason eBPF approaches have a lot of potential in this space.

_8j50 3y ago
Most people can't anycast, and even if they could I did not say that was even a mitigation strategy, you arguing a strawman. "firewall nodes at the edge which use ASIC/FPGA offload" and most people have that? I can't even think of companies that aren't FAANG or CDN providers that have anycastable ASIC enabled firewalls that can handle high pps/rps. > eBPF direct compilation to NPU instructions is already supported on Linux by some devices, which is one reason eBPF approaches have a lot of potential in this space. Ok, I think maybe we are talking about the same thing but what you call "firewalls" are in-house built DDoS scrubbers, which is not what I am talking about. There are also commercial DDoS scrubbers people can use, with or without anycasting. Back to the topic of this thread: firewalls, as in devices that inspect traffic using their CPU. PF based firewalls, sonicwall, fortigate, paloalto, sourcefire, those. You can build your own ddos scrubber compiling eBPF to NPUs and then afford those. Those are highly specialized purpose specific devices, they don't represent what people mean when they think of firewalls, as in ones you can buy or rent. It comes down to capacity, they typically can handle throughout just fine but high number of active sessions and very high pps is where most start choking.

3 ms·

This is definitely false. The effective approach for DDOS mitigation is to anycast the attacked subnet to diffuse the attack and intercept it with firewall nod

by aifooh7Keew6xoo 3y ago

_8j50 3y ago
Most people can't anycast, and even if they could I did not say that was even a mitigation strategy, you arguing a strawman. "firewall nodes at the edge which use ASIC/FPGA offload" and most people have that? I can't even think of companies that aren't FAANG or CDN providers that have anycastable ASIC enabled firewalls that can handle high pps/rps. > eBPF direct compilation to NPU instructions is already supported on Linux by some devices, which is one reason eBPF approaches have a lot of potential in this space. Ok, I think maybe we are talking about the same thing but what you call "firewalls" are in-house built DDoS scrubbers, which is not what I am talking about. There are also commercial DDoS scrubbers people can use, with or without anycasting. Back to the topic of this thread: firewalls, as in devices that inspect traffic using their CPU. PF based firewalls, sonicwall, fortigate, paloalto, sourcefire, those. You can build your own ddos scrubber compiling eBPF to NPUs and then afford those. Those are highly specialized purpose specific devices, they don't represent what people mean when they think of firewalls, as in ones you can buy or rent. It comes down to capacity, they typically can handle throughout just fine but high number of active sessions and very high pps is where most start choking.