Re: [Crisp] IRIS-LWZ and security issues due to spoofed sources

On Feb 27, 2006, at 8:08 AM, Shane Kerr wrote:

> Since this is a general UDP problem, perhaps it makes sense to  
> point to
> another document for this problem. Is there such a thing?

That was gonna be my first question:  just how do they mitigate this  
with DNS?  Or DHCP?  Or anything else that uses UDP?  It seems BCP 78  
is applicable to this.

Also, I was under the assumption that an amplification attack  
resulted in an order of magnitude higher response.  In other words,  
if I send a 100 byte packet, the amplification is in hundreds of  
times higher bytes and usually across multiple packets.  Perhaps if  
we could get a pointer to the classic attack scenario that would help.

According to this:
http://www.lancs.ac.uk/postgrad/pissias/netsec/ddos/index.html
There really are two types of attacks: reflection attacks and  
amplification attacks.  As any interesting as reflection attacks are,  
they don't seem to be that much more gain than a direct attack.  The  
amplification attack usually yields a 300 to 400 times magnification,  
which I do not think IRIS would do.

More reading from CERT:
http://www.cert.org/incident_notes/IN-2000-04.html
The problem, it would seem, in the DNS world is a recursive name  
server configured to answer for anybody.  I don't think this is  
applicable to IRIS.

-andy

_______________________________________________
Crisp mailing list
Crisp@ietf.org
https://www1.ietf.org/mailman/listinfo/crisp