[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: ISAKMP cookies
In message <199705191457.KAA21933@earth.hpc.org>, Hilarie Orman writes:
>There have always been two possible aspects to anti-clogging (or
>denial of service prevention). One is to defer allocation of space,
>the other is to defer computation. I'm happy to have the term refer
>to either one, insofar as the protocol assists either or both.
I'm simply puzzled why we moved away from the Photuris model of
cookies; as you remember, cookies there prevented both problems. And
if you can't do any protocol negotiation (or even worse, if your
machine crawls to a halt), it doesn't matter if the reason is memory
exhaustion or too much computation. Especially since it will be
trivial for anyone, anywhere, to make any ISAKMP daemon run out of
memory as it stands now.
Cheers,
-Angelos
PS. Most of the over-the-network attacks i've seen in the last two
years cause the target system to run out of memory (usually run out of
memory dedicated for some service). Let's not replicate those protocol
failures here.
References: