> Unfortunately, due to performance and security concerns only a handful of large ISP's allow inter-AS flowspec rules. Still - it's worth a try. Check if your ISP is willing to accept flowspec from your BGP router!
Flowspec as a vocabulary allowing users to deploy rules between Autonomus Systems seem to have failed. It is still super useful, mostly within a single AS, if used carefully.
Instead of focusing on flowspec, at Cloudflare we invested in BPF and XDP. We deploy powerful rules on our Linux servers. The flexibility of programmable BPF is light years ahead of anything traditional routers can deliver. Anyhow: there are many ways of doing detection and mitigation, and there is no one right answer. For us BPF did the trick.
We are a Cisco shop and there are a lot of problems on their side too. Initially, there was a paragraph about that, but Cisco is working on these problems, so I didn't want to cause problems yet.
Something like outlined in the article should be doable without too much complexity. However, I also need to be able to use the result for AS12322 and I didn't disclose everything in the article. I need to tinker a bit more.
IMO the most straightforward solution would be to something like:
a) add these 'metric counters' in a little more friendly way than mess with ClickHouse itself (maybe a directory with *.sql to be loaded on the start/file change?)
b) a way to publish them in JSON through the webserver
After that I can just poll the endpoint with a script and do whatever I need with that info.
AFAIR ClickHouse has a built-in REST-like interface, which can be used for that but that means the need to expose ClickHouse itself.
6 comments
[ 3.2 ms ] story [ 22.4 ms ] threadOn my side, our experience with flowspec was not perfect, although arguably it was 10 years ago:
https://blog.cloudflare.com/todays-outage-post-mortem-82515/
https://blog.cloudflare.com/analysis-of-todays-centurylink-l...
https://blog.cloudflare.com/reflections-on-reflections/
> Unfortunately, due to performance and security concerns only a handful of large ISP's allow inter-AS flowspec rules. Still - it's worth a try. Check if your ISP is willing to accept flowspec from your BGP router!
Flowspec as a vocabulary allowing users to deploy rules between Autonomus Systems seem to have failed. It is still super useful, mostly within a single AS, if used carefully.
Instead of focusing on flowspec, at Cloudflare we invested in BPF and XDP. We deploy powerful rules on our Linux servers. The flexibility of programmable BPF is light years ahead of anything traditional routers can deliver. Anyhow: there are many ways of doing detection and mitigation, and there is no one right answer. For us BPF did the trick.
SYN matching https://blog.cloudflare.com/introducing-the-p0f-bpf-compiler...
DNS matching https://blog.cloudflare.com/introducing-the-bpf-tools/
We are a Cisco shop and there are a lot of problems on their side too. Initially, there was a paragraph about that, but Cisco is working on these problems, so I didn't want to cause problems yet.
So you would integrate them?
Anyway, Akvorado is a beautiful piece, kudos.
I just need some time to tinker with it...
a) add these 'metric counters' in a little more friendly way than mess with ClickHouse itself (maybe a directory with *.sql to be loaded on the start/file change?)
b) a way to publish them in JSON through the webserver
After that I can just poll the endpoint with a script and do whatever I need with that info.
AFAIR ClickHouse has a built-in REST-like interface, which can be used for that but that means the need to expose ClickHouse itself.