Internet2 Network Security SIG

[Michael H Lambert <>]

> On 20 Oct 2015, at 12:06, Spurling, Shannon 
> <>
>  wrote:
> 
> Personally, I’m not sold on scrubbing. Sometimes it’s best to scuttle the 
> IP during the attack and adopt some edge based practices that let you have 
> some flexibility at the edge. Some of the lamest (as far as target value or 
> reason behind it) DDOS’s are enormous, and I don’t see any way to 
> effectively scrub them out. Then there’s the camouflaged ones, where you 
> would need something application or state aware to properly remove the bad 
> traffic. That is very computationally expensive.

I also have reservations about scrubbing.  To me it's just paying a 
third-party to do what your provider should be doing as part of their basic 
service (ie, filtering on ingress).  Black hole routes are too broad 
(essentially a concession to the attacker).  There may be promise in 
flowspec, but only if providers are willing to push it to their edge.

Michael