Question 1

What happens to legitimate traffic when asymmetric routing breaks symmetric filters?

Accepted Answer

Symmetric filters drop valid packets because counters fail to match divergent paths. This causes immediate service disruption and revenue loss for platforms unable to tolerate downtime during normal routing fluctuations.

Question 2

Can ReAct run on standard switches or only specific programmable hardware?

Accepted Answer

ReAct requires programmable data planes found in Intel Tofino switches and Nvidia Bluefield-3 SmartNICs. These devices allow custom programs to track transaction IDs across disjointed network segments effectively.

Question 3

Does ReAct introduce false positives that block legitimate user sessions?

Accepted Answer

ReAct eliminates false positives by accurately matching requests and responses regardless of path divergence. This ensures zero percent of legitimate traffic is dropped during asymmetric routing events.

Question 4

How does ReAct handle the massive amplification factors seen in NTP attacks?

Accepted Answer

ReAct validates individual transaction IDs to stop amplified floods without needing symmetric paths. It prevents NTP reflection attacks from generating response streams roughly 500 times larger than queries.

Question 5

What memory overhead does ReAct add when sizing bloom filter bitarrays?

Accepted Answer

Operators must size bloom filter bitarrays against an 11% memory overhead ceiling. Exceeding this limit prevents hash collisions while maintaining high-speed lookup performance on programmable switches.

Reflection on Wirez

Asymmetric routing breaks filters; ReAct fixes it