Re: Route cache performance under stress

["David S. Miller" <davem@redhat.com>]

   From: "CIT/Paul" <xerox@foonet.net>
   Date: Mon, 9 Jun 2003 01:27:48 -0400

   Ahah Jamal!! Yes I have tried.. It does absoutely nothing for the
   constant randomness of packets.
   It increases the overall distribution of the hash in the cache but it
   does nothing for the addition of new packets..
   Try fowarding packets generated by juno-z.101f.c and it adds EVERY
   packet to the route cache.. Every one. And at 30,000 pps
   It destroys the cache because every single packet coming in is NOT in
   the route cache because it's random ips.

So you make packets that do things like this GC the oldest
(LRU) routing cache entry.

This isn't rocket science, and well behaved flows will still get all
the benefits of the routing cache.

The only person penalized will be the attacker since his routing
cache entries will purge out quickly and as a response to HIS traffic.

   Nothing you can do

No, there are many things we can do.

Prove to me that routing caches are unable to behave acceptibly in
random source address DoS situations.

   (I'm not Even sure why this is necessary anyway.. Who would want to
   add every single src/dst flow to a cache?

Because %99 of traffic is well behaved flows, trains of packets.
Even the most loaded core routers see flow lifetimes of at least
8 or 9 packets.

Even if the flows lasted 3 packets, the input route lookup work
saved (source address validation in particular, which requires
access to a centralized global table and thus does not scale well
on SMP) is entriely worth it.