Hacker News Reader

Comment by benjojo12 | Hacker News Reader

Route dampening has mostly fallen out of fashion with networks these days.

Most setups were horribly misconfigured and (most) routers are no longer extremely CPU starved as they once were, That doesn't mean that it does not still exist of course, when I did bgp battleships ( https://blog.benjojo.co.uk/post/bgp-battleships ) I found that 3356 (at the time) was doing route dampening, so play had to be paused for a while.

View on HN

That seems crazy to me. What guardrails are there against a single hacked router pumping 10000 path changes/sec?

The direct peering to the router is likely going to have a bad time, but route advertisement interval I mention in the article is going to coalesce all of those updates together. Downstream peers would only see the one update every 30 seconds (or so).

Yup, unless that component has been disabled (which is quite rare) or the other side is bird, a bgpd that doesn't buffer anything !

See my adjacent comment to yours. I would like to see why you think dampening is out of favor. Interval batching is not an equivalent protection. If you were playing BGP battleships you were likely playing at a rate where a single prefix was not updating more than once per minute.

That wouldn’t land in the dampening levels that were normally configured that encountered with all of the transit providers.

That’s only true if they can be coalesced. Even with RPKI an intermediate transit router can path length flap 100,000 routes every 30 second interval.

Depending on the RA interval alone is negligence and if you encountered a small ISP that isn’t dampening your updates directly, their peering session is at risk with any of the major transit providers.

Route dampening guardrails were super common 7 years ago and there isn’t any technological development that fixes what they did so I highly doubt they fell out of favor.

Reply on news.ycombinator.com