This is a complete lie. All modern "terminal servers" (you know, integrated modems and dialup server hardware) including the Cisco As5300 that you mention are fully capable of filtering traffic based on source address with no real impact on performance. There is absolutely no excuse for an ISP to *not* filter traffic based on source address from one of these devices. There is virtually no added load. A modern AS5300 has a 150MHz R4700 CPU, which in my own experience does not go above 10-15% load even under full use (96 modems @56K with lzs compression turned on). The average load is around 6%. Now Cisco has AS5300 units that can hold 192 modems. Double my load figures, 30% peak and 12% standard. How is it that people can use underpowered equipment as an excuse to avoid filtering? Assume your equipment does not provider filtering capabilities? Use OpenBSD, NetBSD, or whatever you prefer, and do some filtering in between. For under $500 USD you can put together an i386 system with decent PCI NICs (such as Intel EtherExpress PRO/100) which can handle 35-60Mb/sec of traffic (unless you start hitting it with tons of small packets like a massive smurf attack or udp flood). Say you have a T3...With a system that can handle 40Mb/sec, you could use it to filter most all of your traffic, not just from your dialup servers. The more filter rules you add, the slower it becomes, but this really isn't a huge issue until you are talking about hundres of rules. With capabilities like head/group in IP Filter, you can make it extremely efficient. On Tue, 15 Feb 2000, Alan Brown wrote: | On Sun, 13 Feb 2000, Darren Reed wrote: | | > You know if anyone was of a mind to find someone at fault over this, | > I'd start pointing the finger at ISP's who haven't been doing this | > due to "performance reasons". | | To be fair, if you do this on most terminal servers (eg, Cisco 5300, Max | 4000), they will collapse under the load. | | > They've had the ability to do it for | > years and in doing so would seriously reduce the number and possibility | > of "spoofing" attacks. | | See above. Having enough CPU available to handle spoof filtering from | dialups adds a lot to costs and most ISPs simply can't afford to pay | more in order to be able to provide that benefit. :-( | | AB | --- Gates' Law: Every 18 months, the speed of software halves.
This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 15:35:23 PDT