Re: [Ntp] Rate limiting: DDoS, KoD, Pool, NAT

[Hal Murray <[e-mail]>]

[e-mail] said:
> My point was that the address stuffed into the cookie/nonce would mismatch
> the address in the source address of the IP packet once it got SNAT’d.

> It sounded like you were tacitly counting on the two being a match. 

I think it works, but maybe I'm missing something.

Server behind NAT box:
  Server gets clients correct IP Address which goes into the cookie.
  When the cookie comes back, it has the same IP Address and matches.

Client behind NAT box:
  Server gets address of NAT box.  That goes into cookie.
  When the cookie comes back, it has the same address (NAT box) and matches.

Note that "IP Address" in the above does not include the port number.

I think the key idea is that both ends don't have to agree on what the IP 
Address is.  The server both inserts the IP Address into the cookie and checks 
it when the cookie comes back.  As long as the packet comes from the same NAT 
box things will match.

If there are multiple clients behind the NAT box, one of them could use his 
cookies to DoS another system behind the same NAT box.


-- 
These are my opinions.  I hate spam.