Re: Using cookies/computational effort to defeat syn-flooding

["Donald E. Eastlake 3rd" <[e-mail]>]

There are two facets to this problem, as I see it.  One is spam
packets of any type that have forged sources, can't be easily traced
due to ISPs not being prepared to do this, etc.  The second is fragile
mechanisms that are easily toppled even without any forgery.  While we
need to fix the second where we can, there will always be packets that
can cause trouble and evem just a string of nonsense packets firehosed
at a host can degrade/deny service to others due to bandwidth
considerations.  ((Actually I wonder what the chance is that mostly
random packets would crash the IP stack in an average host...  Seems
like the kind of test everyone would know you should do on your
software but who knows...))

I think we need to always worry about the first with some sort of IP
level mechanism that is very much cheaper than any of the current
IPSECs and which also provides some assistance in tracing back the
physical origin of packets.

The Internet is increasingly under attack and we need continuing effort
at making it more robust at all levels.

Donald