CAREFUL DDOS SECLUDING WITH QUICK LPM

Abstract

Can volumetric distributed denial-of-service (DDoS) streams be effectively dampened by software-based packet filters in an era when 10 Gbps links are considered slow? The potential of LPM to enforce precise DDoS scrubbing policies seems to be underutilized in contemporary packet filtering data paths, as we argue in this paper that whitelist/blacklist LPM-based filtering can be made effective with commodity hardware. Because of its lockless architecture and small memory footprint of LPM structures, our suggested showcase data path has a healthy scaling potential and can evaluate multiple queries in large separate LPM databases for each forwarded 64-byte packet while maintaining a 10 Gbps line rate on a single CPU core. We demonstrated how to send 64 million by using only six CPU cores. KEYWORDS: Firewalls, Network Security, Packet Lookup and Classification, Software Routers