Re: [IPsec] IPsec Digest, Vol 123, Issue 21

Tero Kivinen <kivinen@iki.fi> Tue, 19 August 2014 16:44 UTC

MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Message-ID: <21491.32501.475060.892333@fireball.kivinen.iki.fi>
Date: Tue, 19 Aug 2014 19:44:37 +0300
From: Tero Kivinen <kivinen@iki.fi>
To: Paul Wouters <paul@nohats.ca>
In-Reply-To: <alpine.LFD.2.10.1408191041490.19423@bofh.nohats.ca>
References: <mailman.4236.1406823571.13632.ipsec@ietf.org> <A0463391-0BB4-408F-874B-A6B91ED6D102@gmail.com> <21490.4420.127387.489490@fireball.kivinen.iki.fi> <alpine.LFD.2.10.1408181229340.25715@bofh.nohats.ca> <21491.9709.148603.972986@fireball.kivinen.iki.fi> <alpine.LFD.2.10.1408191041490.19423@bofh.nohats.ca>
Archived-At: http://mailarchive.ietf.org/arch/msg/ipsec/zl0soFTwdftGh3MoD7GmIYHYvDQ
Cc: ipsec@ietf.org, Les Leposo <leposo@gmail.com>
Subject: Re: [IPsec] IPsec Digest, Vol 123, Issue 21
Precedence: list

Paul Wouters writes:
> On Tue, 19 Aug 2014, Tero Kivinen wrote:
> 
> >> You would need the port number too to support multple clients behind the
> >> same NAT router, upon which the attacker can then use multiple ports too.
> >
> > No need for port number. If server is under attack just block / slow
> > down everybody using the same IP-address (or IP-address mask).
> 
> Works great with CGN :P

Yes, blocks the nicely. Just what they asked for... :-)

On the other hand CGD should notice if there is widespread DoS attack
done through it, and hopefully someone will block those attacks in
there... Those attacks will consume quite a lot of resources on the
CGD so operators would actually like to block them.
-- 
kivinen@iki.fi

Re: [IPsec] IPsec Digest, Vol 123, Issue 21 Les Leposo
Re: [IPsec] IPsec Digest, Vol 123, Issue 21 Yoav Nir
Re: [IPsec] IPsec Digest, Vol 123, Issue 21 Les Leposo
Re: [IPsec] IPsec Digest, Vol 123, Issue 21 Tero Kivinen
Re: [IPsec] IPsec Digest, Vol 123, Issue 21 Paul Wouters
Re: [IPsec] IPsec Digest, Vol 123, Issue 21 Les Leposo
Re: [IPsec] IPsec Digest, Vol 123, Issue 21 Les Leposo
Re: [IPsec] IPsec Digest, Vol 123, Issue 21 Paul Wouters
Re: [IPsec] IPsec Digest, Vol 123, Issue 21 Les Leposo
Re: [IPsec] IPsec Digest, Vol 123, Issue 21 Tero Kivinen
Re: [IPsec] IPsec Digest, Vol 123, Issue 21 Tero Kivinen
Re: [IPsec] IPsec Digest, Vol 123, Issue 21 Les Leposo
Re: [IPsec] IPsec Digest, Vol 123, Issue 21 Yoav Nir
Re: [IPsec] IPsec Digest, Vol 123, Issue 21 Paul Wouters
Re: [IPsec] IPsec Digest, Vol 123, Issue 21 Paul Wouters
Re: [IPsec] IPsec Digest, Vol 123, Issue 21 Les Leposo
Re: [IPsec] IPsec Digest, Vol 123, Issue 21 Les Leposo
Re: [IPsec] IPsec Digest, Vol 123, Issue 21 Yoav Nir
Re: [IPsec] IPsec Digest, Vol 123, Issue 21 Les Leposo
Re: [IPsec] IPsec Digest, Vol 123, Issue 21 Tero Kivinen
Re: [IPsec] IPsec Digest, Vol 123, Issue 21 Les Leposo