IETF Logo Mail Archive

Re: [Mud] Simplified Quarantine model

tirumal reddy <kondtir@gmail.com> Wed, 24 July 2019 05:56 UTC

Return-Path: <kondtir@gmail.com>
X-Original-To: mud@ietfa.amsl.com
Delivered-To: mud@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A5BB512003F for <mud@ietfa.amsl.com>; Tue, 23 Jul 2019 22:56:04 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.998
X-Spam-Level:
X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uWgehkcLhz_3 for <mud@ietfa.amsl.com>; Tue, 23 Jul 2019 22:56:02 -0700 (PDT)
Received: from mail-io1-xd2e.google.com (mail-io1-xd2e.google.com [IPv6:2607:f8b0:4864:20::d2e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BEF7E120332 for <mud@ietf.org>; Tue, 23 Jul 2019 22:56:02 -0700 (PDT)
Received: by mail-io1-xd2e.google.com with SMTP id k20so87002180ios.10 for <mud@ietf.org>; Tue, 23 Jul 2019 22:56:02 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=iHji0cKMvAYqk3jI31pfY5G7yTUUegpeNqTl65PvQMI=; b=jtmd/y9ccSJ8F0OzAp4Ph0A9/3857uPgdxYeXusj210U3ihgpBTSV/+5uWNrfA7u7B +HrzPuwki5cYmPkgeL9nWFiXlefAIspqIfIZoU3rzl0IpcDl3iQaWQaonwKPFy9/bmNM 9SxxLoxyvr+wmj5yeJzdRxJXCCmZ0Rjtyxr+z6C4O2wvp0+t1fv6hQ6bynD6zbifEa36 aK7D/F/hvtmhuFY8zB8RZRIAn9VbUNhbInflCTQJSwu+Rk0ZE3hnoYQR5/rqMfW+Yfid mFVZboTDus1EdDwxITBO2GdWc7QGZl5wH1CQqWVCYY65KlpIqZZYXqEGsZGaywYpoSSl xqpA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=iHji0cKMvAYqk3jI31pfY5G7yTUUegpeNqTl65PvQMI=; b=badxYIyZvMxfWes9p1M81u3ps2t24rLLL3tIg/oQwO5b7jHaeroLpu55Bn2fXmQV04 cm3LUWuR7ICPVJ00ykBVozBTWCzLnMqTfZnNCTEMcTeEM6VgfE/bLJY8G7Fm0o+A9mRY QMVl6inaLhWNpLsAigVa2WaPC7V1PeEnuVVqvV+XnMHqzoRidP/FSO80zgpsHe1684S0 zcch8ILPHwwU7uybnPgxtiD1VRtySZAWZ7rutMXwGIIrlow08iatheqLnMSL6wNoVSLd Uv7tntvRJHc+XVSTT+4/Q+ZJK0/2bz5svLyS705C9si4cTU7mmOWb9YX9nDPMszUjlYy VnXQ==
X-Gm-Message-State: APjAAAVpcswTkliHe4zEFEJxgHz/Ek+8YOZgTtpJTiSUWKjOA6h0EXW8 I/gaxk2xFir10ZPa3NYxTMwZHfk/d+nbA8BY2eA=
X-Google-Smtp-Source: APXvYqw1SqaxedZBTS6Jnq0G6RY+UM1/h6qUEz8nma/6wa0DH4HGor6FZwoafnveMdAMY0RtW67o5gdDCeiYlqjiduw=
X-Received: by 2002:a02:bb08:: with SMTP id y8mr38718044jan.51.1563947762091; Tue, 23 Jul 2019 22:56:02 -0700 (PDT)
MIME-Version: 1.0
References: <CAHiu4JM3oZkXzasiqF9vYzrHFsvDvR446evShQBAXnW46nNXdQ@mail.gmail.com> <CAFpG3gd=4vd5oY72pS4o2f3VrjuxCUr6OL==tNR8hXVHJmRJcw@mail.gmail.com> <2235.1563923254@dooku.sandelman.ca>
In-Reply-To: <2235.1563923254@dooku.sandelman.ca>
From: tirumal reddy <kondtir@gmail.com>
Date: Wed, 24 Jul 2019 11:25:50 +0530
Message-ID: <CAFpG3gf2uch57CWpySbgyfhQq2ZEyjFfsrP7Rzt4CSq5-2VVDA@mail.gmail.com>
To: Michael Richardson <mcr@sandelman.ca>
Cc: "M. Ranganathan" <mranga@gmail.com>, mud@ietf.org
Content-Type: multipart/alternative; boundary="000000000000ce8a77058e66f632"
Archived-At: <https://mailarchive.ietf.org/arch/msg/mud/sTtxb33wjbAIXzPwbSbve06vJ_4>
Subject: Re: [Mud] Simplified Quarantine model
X-BeenThere: mud@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Discussion of Manufacturer Ussage Descriptions <mud.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/mud>, <mailto:mud-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/mud/>
List-Post: <mailto:mud@ietf.org>
List-Help: <mailto:mud-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/mud>, <mailto:mud-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 24 Jul 2019 05:56:09 -0000

On Wed, 24 Jul 2019 at 04:37, Michael Richardson <mcr@sandelman.ca> wrote:

>
> tirumal reddy <kondtir@gmail.com> wrote:
>     > How do you identify an attacker is using the victim device's MAC and
> IP
>     > address to send attack traffic (e.g. SYN flood) ?
>
> On wired, this has to be protected by using a managed switch and
> then locking ports down to mac addresses.
>
> On wireless, one needs unique PSKs (or Enterprise WPA), which then one can
> identify which device is which, and lock the MAC address down.
>
> Of course, all this fails if the devices are expected to randomize the L2
> address.
>

Yes, the problem is in Home networks and Enterprise networks already use
various techniques to detect MAC spoofing.

-Tiru


>
> --
> ]               Never tell me the odds!                 | ipv6 mesh
> networks [
> ]   Michael Richardson, Sandelman Software Works        | network
> architect  [
> ]     mcr@sandelman.ca  http://www.sandelman.ca/        |   ruby on
> rails    [
>
>

v2.23.0 | Report a Bug | By Email