Hacker News Reader

There are likely real hardware limits on consumer oriented Internet access gear. Some Googling suggests they may hardware accelerate NAT and I'm sure there are limits on the number of NAT entries that fit in the Broadcom memory. ONTs have to be very cheap, think $100 or less, and there's a lot of functionality in there. If you need beyond consumer functions you may need to upgrade to business service or similar.

View on HN

This device doesn't NAT so it doesn't need to track connections. Removing this "DOS prevention" feature would make the device cheaper.

In a residential setting there could be capacity limitations/oversubscription that needs to be protected by "DDoS" mitigation at each customer edge. It could do dumb rate limiting which would affect youtube uploads etc., or it could look at flows and try to nuke "obvious" outbound DDoS attacks.

CenturyLink ONTs are set up to do the bare minimum. Think bridge mode. No NAT. There is a separate CPE router to terminate one end of the PPPoE connection and do NAT as required.

Reply on news.ycombinator.com