[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: IKE transport (was INITIAL-CONTACT issues)
>>>>> "Dan" == Dan McDonald <danmcd@Eng.Sun.Com> writes:
Dan> There is nothing to stop malicious injections of RST packets
Dan> into a TCP stream. This is the biggest reason to not use TCP
Dan> for IKE. You'll never get past the 3-way handshake if you have
Dan> a malicious eavesdropper.
You're talking about an active attack here, not an eavesdropper
(passive attacker). And this is a denial of service attack. Sure,
you can prevent the TCP connection from establishing. Likewise, I
believe, you can prevent an IKE handshake from completing by inserting
suitable packets, or deleting others.
I wouldn't think that anyone claims IKE to be resistant to denial of
service attacks. Are you saying it is?
paul
Follow-Ups:
References: