From: William Dauchy <william@gandi.net>
To: Sander Eikelenboom <linux@eikelenboom.it>
Cc: Wei Liu <wei.liu2@citrix.com>,
Ian Campbell <Ian.Campbell@citrix.com>,
William Dauchy <william@gandi.net>,
Ahmed Amamou <ahmed@gandi.net>,
xen-devel <xen-devel@lists.xen.org>,
Kamel Haddadou <kamel@gandi.net>
Subject: Re: [PATCH v3 1/3][xen-netback] add a pseudo pps rate limit
Date: Tue, 9 Jul 2013 17:19:03 +0200 [thread overview]
Message-ID: <20130709151903.GO20956@gandi.net> (raw)
In-Reply-To: <1026657527.20130709164229@eikelenboom.it>
[-- Attachment #1.1: Type: text/plain, Size: 862 bytes --]
On Jul09 16:42, Sander Eikelenboom wrote:
> Ok so the main usage scenario is not inbound traffic from the outside world that issues a (D)DOS,
> but rather a (malicious) guest that could issue a DOS on the host system by
> draining the resources of the netback driver by sending many packets per second.
> And that this scenario can't be circumvented with netfilter because it doesn't come into play yet (on the host).
yes Sander your example perfectly illustrates the worst case.
IMHO it makes sense to filter traffic as soon as possible.
Using netfilter for inbound traffic could make sense but outbound
filtering in netfront would be the best choice; this solution sounds too
risky. For outbound traffic even if the host is not the target of the
DDOS attack, netfilter will consume way more resources in order to stop
the attack.
--
William
[-- Attachment #1.2: Digital signature --]
[-- Type: application/pgp-signature, Size: 198 bytes --]
[-- Attachment #2: Type: text/plain, Size: 126 bytes --]
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel
next prev parent reply other threads:[~2013-07-09 15:19 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-07-09 12:24 [PATCH v3 0/3][xen-netback][toolstack] add a pseudo pps limit to netback William Dauchy
2013-07-09 12:24 ` [PATCH v3 1/3][xen-netback] add a pseudo pps rate limit William Dauchy
2013-07-09 13:48 ` Sander Eikelenboom
2013-07-09 14:01 ` William Dauchy
2013-07-09 14:42 ` Sander Eikelenboom
2013-07-09 15:19 ` William Dauchy [this message]
2013-07-10 12:50 ` Ian Campbell
2013-07-10 13:59 ` Sander Eikelenboom
2013-07-10 8:51 ` Wei Liu
2013-07-09 12:24 ` [PATCH v3 2/3] handle pps limit parameter William Dauchy
2013-07-10 8:32 ` Wei Liu
2013-07-09 12:24 ` [PATCH v3 3/3] netif documentation William Dauchy
-- strict thread matches above, loose matches on Subject: below --
2014-12-18 8:13 [PATCH v3 1/3][xen-netback] add a pseudo pps rate limit Jian Wen
2014-12-18 10:00 ` Sander Eikelenboom
2014-12-18 10:16 ` Jian Wen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20130709151903.GO20956@gandi.net \
--to=william@gandi.net \
--cc=Ian.Campbell@citrix.com \
--cc=ahmed@gandi.net \
--cc=kamel@gandi.net \
--cc=linux@eikelenboom.it \
--cc=wei.liu2@citrix.com \
--cc=xen-devel@lists.xen.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).