Subject: Re: [lisp] 32-bit nonce in map request insufficient

From: [email-masked] (Noel Chiappa)
Date: Wed, 9 Sep 2009 14:20:25 -0400 (EDT)

> From: Margaret Wasserman <[email-masked]>

    >> Remember these map replies will be > rate limited

    > I realize that the LISP spec says that the sender should rate limit
    > its replies, but attackers don't typically follow that sort of
    > advice.

Umm, he was referring to rate-limiting in the destination ITR, not in
the sources:

    >> The key isn't the access link speed, it's the capacity of the
    >> control plane of the ITR and the rate limiting mechanisms into the
    >> control plane. This will result in a _few hundred_ packets per
    >> second of map-replies being the maximum allowed by the implementation. 

Most control-planes have rate-limiting mechanisms built into them
(actually, into the forwarding-plane -> control-plane transfer mechanisms,
in many cases) to prevent a variety of DoS attacks using large amounts of
traffic.

	Noel