RE: draft status, BoF, replies to issues

[Pekka Savola <pekkas@netcore.fi>]

On Fri, 20 Feb 2004, Ross Callon wrote:
> If I am doing the math right:
> 
>          - 10,000,000,000 bbs (OC192) divided by 40 bytes per packet 
>          - implies 31,250,000 packets per second are being hit by the 
>            filter. 
> 
> Assuming that the 32 bit number is a positive integer (so that you
> don't have a sign bit, and can count all the way up to (2^32)-1:
> 
> This will wrap around in a little more than two minutes.
> 
> Which implies that 64 bit counters are a good idea, at least in 
> some cases. 

This is not just theory -- we implement rate-limiting in our our edge.  
When we were hit by 2.5 Mpps DoS attack, the numbers jumped up to
something like 300 billion packets (AFAIR) pretty quickly.  And that
wasn't even close to a line-rate attack.  The situation where the
counter would have wrapped at 32 bits would have been unacceptable, as
we might not have been able to appreciate the extent of the attack.

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings