Home page logo

nanog logo nanog mailing list archives

Re: NSPs and filters
From: Daniel Senie <dts () proteon com>
Date: Sun, 13 Jul 1997 10:28:01 -0400

Vadim Antonov wrote:

randy> So, at POP X, I take in maybe 100 prefixes, with maybe 1000
randy> at some POPs.  How do I build and maintain that filter list,

alan () mindvision com (Alan Hannan) wrote:

 The same way you build and maintain routing filter lists for the
 prefixes you take in.

Bzzt. Routing filter lists are applied to routing updates.  Packet
filter lists are applied to packets.

Big difference.

He suggested that the SAME list of prefixes be filtered. Or to put it
another way, if you're concerned about the work involved in creating
your filter lists, you already have the data. Now onto the performance

1000-entry packet filter will slow any existing router down to crawl,

No. This is not true. Well designed filtering software WILL perform
under these circumstances. It becomes more of a challenge as the speed
of wires increases, but at a T1 rate, it is NOT very hard, and will not
slow "any existing router" though it may slow some.

and practically all future boxes won't do any better.

Would you care to explain just exactly WHY a CAM type architecture could
not filter packets WHILE BEING RECEIVED from a given type of wire? This
is NOT an unsolveable problem. Perhaps you've been blinded by the
current architecture of the equipment you've invested in to date.

Daniel Senie                  dts () openroute com
OpenROUTE Networks, Inc.      http://www.openroute.com/

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]