On Wed, 28 Jul 1999, Greg A. Woods wrote:
[ On Wednesday, July 28, 1999 at 11:21:35 (-0400), Daniel Senie wrote: ]
Subject: Re: SYN spoofing
In fact it's easy to buy off-the-shelf hardware today that can do wire-speed filtering, assuming one has worked such costs into the budget of building a network backbone....
It is possible to do access filtering on the edges. Then comes the operational aspects of actually making such a thing scale across many many edge devices, especially when there are customers with their own space, and who may have customers behind them with _their_ own space. If a promising local isp is providing transit to a bunch of other local isps, changing every access-list on every edge node every time one of the customer isp's adds or deletes a customer, becomes a logistical nightmare. Some promising local isp's are then faced with blowing out huge access-lists virtually every hour of the day, and this becomes harder to manage when you take into accounts and now you have several tens of promising local isps all trying to match access-lists all around. Not to mention the actual physical limits on current hardware regarding the size of configurations. /vijay