Re: Carpet bombing, what's it look like now

On Sat, 1 Aug 2026 at 14:05, Vincent Bernat <[email protected]> wrote:

> I was focused on the very short attacks. The issue is not sampling, but
> the flow cache adding some latency, even when tuned down. That's the
> part IE 315 fixes: there is no cache anymore and the sampled packets are
> sent directly.

I don't think that's accurate either.

There is no reason why you couldn't cache in IE 315, I think. You'd be
very unlikely to have a cache line created, then exported, and then be
hit again before export. But that's true for caches generally for all
typical implementations. People are running 1:10k, 1:5k, 1:1k, 1:500,
most of these cache does nothing but delay export, 99.9% entries will
never be hit again after creation and before export.

But again, this is not IE 315 feature, there is no reason why you must
cache in IPFIX, some platforms, like PTX do not cache ever at all, no
matter the config.

-- 
  ++ytti
_______________________________________________
NANOG mailing list 
https://lists.nanog.org/archives/list/[email protected]/message/YX7D33Y2HI3JG55VEIKWIWZQNVKPZKZI/