Re: forgery-resilience recommendations section

[Michael Graff <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Andreas Gustafsson wrote:

> In the case of a server using a single port, we already assume that
> the attacker has a way of determining which port is in use.  The
> methods the attacker may use for doing that easily extend to multiple
> ports, so we must also assume that the attacker now has a way of
> determining the _set_ of ports currently in use.  If he does that
> determination immediately before the attack, and repeats it frequently
> enough during an extended attack, he will be able to track any changes
> in the set.

That would almost imply that using one port for a server would actually
limit the ability to attack other servers if they have a chance to use a
different port.

That is, if an attacker could only detect a limited number of ports a
server uses (say, out of 16), the others would still be unknown
quantities from the attacker's point of view.

If, on the other hand, a random port were used, it's only a matter of
time before all ports were detected.

- --Michael

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)

iD8DBQFGwzFBZXirchfeIY0RAr8sAJ96Lp5E6EdIAOKRDeTWkUd7JHOV1wCgktcm
ljpzBVPxcz9LG8KH5iqpGP4=
=dvqT
-----END PGP SIGNATURE-----

--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>