[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

resistance to swamping attacks.

at the last IETF meeting, there was a presentation about how cookies
don't necessarily help all that much.

There have been a number of press reports about swamping attacks on
TCP using forged source addresses.  Some of these press reports have
suggested that IPv6 will solve all this by requiring authentication.

I'd like this to be the truth, not just optimism..

I think that one of the not-well-stated requirements of ipsec is that
it resist such attacks -- most importantly, that a system be able to
continue to communicate with legitimate peers in the face of a
packet-storm, including peers it did not have any shared state with
prior to the start of the storm.

Here's a more specific goal:

If a system has a normal communications bandwidth of X, and recieves
an incoming storm from forged source addresses with a bandwidth of Y
(less than X), it should be able to continue to use at least half of
the remaining bandwith (X-Y) constructively to communicate with
arbitrary legitimate peers, including peers which had never before
communicated with it.

Now, at some level, this is a property of the implementation, but
nothing in the *protocol* should preclude this.

Any objections?

					- Bill

To: Roy Pereira <rpereira@timestep.com>
Cc: Lewis McCarthy <lmccarth@cs.umass.edu>, 'IPSEC' <ipsec@TIS.COM>
Subject: Re: Concerns 
In-Reply-To: Your message of "Wed, 18 Sep 1996 17:09:38 EDT."
             <1996Sep18.165500.1121.46786@tsntsrv1.timestep.com> 
Reply-To: perry@piermont.com
X-Reposting-Policy: redistribute only with permission
Date: Thu, 19 Sep 1996 12:11:40 -0400
From: "Perry E. Metzger" <perry@piermont.com>
Sender: ipsec-approval@neptune.tis.com
Precedence: bulk
Message-ID:  <9609191242.aa09079@neptune.TIS.COM>


Need I point out, folks, that this is the IETF?  We do not vote.

.pm

Roy Pereira writes:
> 
> >> A quick way to solve this small (and irrelevant) discussion is to have   
> an
> >> online vote by having everyone email one person with an answer to the
> >> following question:
> 
> >Are you volunteering ? :)
> 
> It would be best if we had an impartial, responsible and trustworthy   
> person to keep track of the vote, like perhaps tke mailing list admin, so   
> there wouldn't be any dispute over the vote results.
> 
> >>   Pick one:
> >>
> >>    b) ISAKMP/OAKLEY
>  ~~~~~~~~~~~~~
> 
> >(No Photuris ?)
> 
> Of course, we could include any number of KMPs, but ISAKMP and SKIP seem   
> to be the most popular at this time.
> 
> 
>
Follow-Ups: