Comment by daniel-cussen

3 years ago

Yeah FPGA's are marketed for packet inspection. Like on xilinx.com, and microsemi.com, they talk about radar and military, defense, on top of AI and fintech. It's just really hard to market FPGA's, it's such a shiny toy but then it never ends up actually selling in volume, like GPUs, there's envy of that success. Especially because in many ways F's have merits that go toe-to-toe with GPU, and defeat them in eg latency, which is why Wall Street prefers F's to GPU's. Just not enough killer apps.

And packet inspection is a good fit for F's [FPGA's] by their very nature, DDoS's are squirrely and ASICs get stale, you need to reprogram you F's on the fly to catch that attack in-progress. So to adapt to new attacks on the fly, or update based on new fashions of DDoS's, patch vulnerabilities, and plus they're harder to reverse-engineer than ASICs, they're strong against that, good crypto to protect the bitstreams that define them. Basically built for that. ASICs on the other hand, can just have the lid scraped, take a photo, done. (Though to some extent they do put functionality on memory that gets lost if the chip is turned off during abduction, that can be done, the line between F's and ASICs is not truly that sharp).

A lot of DDoS's are done by state-sponsored or -affiliated or -harbored adversaries, capturing the ASIC that stops the DDoS is a real thing. Reverse engineering usually happens in another country, another jurisdiction. Under smiling eyes, blind eyes, can't get the police to go there, can't get extradition, maybe sue, maybe get them punished within the country that harbors them.[1]

[1] I read in China there was a Chinese man who traveled to New Zealand and murdered somebody, I think a woman. But he would not be extradited. Instead, the New Zealanders presented their evidence in Chinese court, which found it had merit and credibility enough to imprison the murder, within China, so he paid for his crimes fully. All without extraditing one of their own.

Amidst all the discussion of fpga vs asic vs flowspec, it's probably worth distinguishing two types of attacks: big, dumb volumetric ddos (flow specifications are great and cheap here, if you can match), and more sophisticated layer 5/6/7 attacks where FPGA/packet inspectors are likely necessary (unless you get lucky and the supposedly smart attack has an obvious signature such as a particular packet length combined with other components)