From: Brent Cook <bcook@breakingpoint•com>
To: Eric Dumazet <eric.dumazet@gmail•com>
Cc: <netdev@vger•kernel.org>
Subject: Re: Possible DoS with 6RD border relay
Date: Wed, 4 Jan 2012 11:35:54 -0600 [thread overview]
Message-ID: <201201041135.54071.bcook@breakingpoint.com> (raw)
In-Reply-To: <1325697931.2428.33.camel@edumazet-HP-Compaq-6005-Pro-SFF-PC>
On Wednesday, January 04, 2012 11:25:31 AM Eric Dumazet wrote:
> Le mercredi 04 janvier 2012 à 11:02 -0600, Brent Cook a écrit :
> > I forgot to mention, I'm testing 3.2 rc7:
> >
> > Linux target1 3.2.0-7-generic #13-Ubuntu SMP Sat Dec 24 18:06:57 UTC 2011
> > x86_64 x86_64 x86_64 GNU/Linux
> >
> > but the same behavior occurs with 2.6.35
>
> Please check :
>
> grep . /proc/sys/net/ipv6/route/*
/proc/sys/net/ipv6/route/gc_elasticity:9
/proc/sys/net/ipv6/route/gc_interval:30
/proc/sys/net/ipv6/route/gc_min_interval:0
/proc/sys/net/ipv6/route/gc_min_interval_ms:500
/proc/sys/net/ipv6/route/gc_thresh:1024
/proc/sys/net/ipv6/route/gc_timeout:60
/proc/sys/net/ipv6/route/max_size:4096
/proc/sys/net/ipv6/route/min_adv_mss:1220
/proc/sys/net/ipv6/route/mtu_expires:600
This is a system with 8GB of ram.
If I modify gc_thresh to be >= the number of bits the client varies, the
system works OK:
/proc/sys/net/ipv6/neigh/default/gc_thresh1:128
/proc/sys/net/ipv6/neigh/default/gc_thresh2:512
/proc/sys/net/ipv6/neigh/default/gc_thresh3:1024
root@target1:~# echo 200000 > /proc/sys/net/ipv6/neigh/default/gc_thresh1
root@target1:~# echo 200000 > /proc/sys/net/ipv6/neigh/default/gc_thresh2
root@target1:~# echo 200000 > /proc/sys/net/ipv6/neigh/default/gc_thresh3
But it seems to be a losing battle since the client has a delegated prefix of
/64.
next prev parent reply other threads:[~2012-01-04 17:36 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-01-04 16:48 Possible DoS with 6RD border relay Brent Cook
2012-01-04 17:02 ` Brent Cook
2012-01-04 17:25 ` Eric Dumazet
2012-01-04 17:35 ` Brent Cook [this message]
2012-01-04 17:53 ` Eric Dumazet
2012-01-04 19:26 ` Brent Cook
2012-01-05 4:22 ` Brent Cook
2012-01-05 19:20 ` David Miller
2012-01-04 17:02 ` Eric Dumazet
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=201201041135.54071.bcook@breakingpoint.com \
--to=bcook@breakingpoint$(echo .)com \
--cc=eric.dumazet@gmail$(echo .)com \
--cc=netdev@vger$(echo .)kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox