Re: [core] Consensus on using Echo to mitigate NoSec amplification?

[Christian Amsüss <[e-mail]>]

On Tue, Feb 25, 2020 at 02:19:33PM +0100, Carsten Bormann wrote:
> Would the CoRE WG be fine with expanding the “updates 7252” text in
> draft-ietf-core-echo-request-tag to also include recommending this
> mitigation?  If you have a position on this, please reply to the list
> (or to the chairs) by March 2nd.

The current version stays as vague on what a larger response is as
RFC7252, I'd like to sharpen that when incorporating the above. My
current corner points are "a TCP SYN+ACK is 3 byte larger than a SYN",
and that NTP had a factor-200 amplification built in earlier versions
(though that's probably UDP-only, and headers'd make that more like
factor-50).

Is there any guidance that could be referenced, eg. an RFC that puts a
number to what consitutes an amplification attack vector? Even [RFC4732]
only talks of "significantly greater" packages.

Thanks
Christian

[RFC4732]: https://tools.ietf.org/html/rfc4732#section-3.1

-- 
Build a man a fire, and he'll be warm for a day. Set a man on fire, and
he'll be warm for the rest of his life.
  -- Terry Pratchett (attributed)