Re: Fair Queuing combats DDoS? [was Re: Yahoo! Lessons Learned ]

[Alex Bligh <amb () gxn net>]

Alexei Roudnev (alex () genesyslab com) said:
> [deploy WFQ and RPF universally]
> Then , if someone want to kill yahoo (for example), he need a few
> thousands  different data streams to do it - which is impossible.

Several thousand different data streams is exactly what DDoS is. Also
there is a presumed high correlation with people who do not secure
their servers adequately againts intrusion (and thus turning
these things into DDoS clients) and people who do not run RPF right
next to those servers.

Therefore this is only 'impossible' if there are not more than 2000
servers sitting on clueless or fallible peoples network. Recent experiences
with internet scaling suggest even if this were true now (which
it isn't), it won't last long.

-- 
Alex Bligh
VP Core Network, Concentric Network Corporation
(formerly GX Networks, Xara Networks)