On Wed, 6 Jan 2010 04:53:17 +0000 "Dobbins, Roland" <rdobbins@arbor.net> wrote:
On Jan 6, 2010, at 11:43 AM, George Bonser wrote:
Yes, you have to take some of the things that were done in one spot and do them in different locations now, but the results are an amazing increase in service capacity per dollar spent on infrastructure.
I strongly agree with the majority of your comments, with the caveat that I've seen many, many load-balancers fall over due to state-exhaustion, too; load-balancers need northbound protection from DDoS (S/RTBH, flow-spec, IDMS, et. al.), as well.
And that is the crux of the matter. Any time you maintain state in the network (e.g. stateful firewalls), you're vulnerable to traffic based attacks that can exhaust that state. The Internet is scalable because the (soft) state that it maintains, namely route tables, isn't dependent on or influenced by the traffic that is forwarded through it. Hosts have to maintain state about their connections - there is no choice. However, the more you're able to push state tracking to the hosts, you end up with less consequences of state targeted attacks, and more scalable architectures.