[pmtud] Improvement for the current PMTUD mechanism

Folks,

Since August 2004 I have been woeking on an internet-draft on ICMP attacks 
against TCP. One of the attacks the draft addresses is a "blind 
performance-degrading attack" in which the traditional PMTUD is exploited 
to reduce the size of the packets used for a given connection.

We (me, and the community, including "traditional" vendors, open source 
ones, etc.) have been able to work out an improvement to the current PMTUD, 
to mitigate its security implications.

The fix just tries to address that. By no means is it an alternative to 
PLPMTUD. For instance, it does not address ICMP blackholes.

I'd like to get feedback from this WG on the PMTUD fix. I think the 
proposed mechanism could be used in some broader PMTUD such as PLPMTUD, so 
that ICMP can be used without the security implications of the traditional 
PMTUD, and thus the same convergnece time than the tradtional PMTUD could 
be achieved.

The draft will soon be available from the internet-drafts public 
repository. In the mean time, you can access it through my web site: 
http://www.gont.com.ar/drafts/draft-gont-tcpm-icmp-attacks-04.txt 
(http://www.gont.com.ar/drafts/icmp-attacks-against-tcp.html)

Kindest regards,

--
Fernando Gont
e-mail: fernando@gont.com.ar || fgont@acm.org

_______________________________________________
pmtud mailing list
pmtud@ietf.org
https://www1.ietf.org/mailman/listinfo/pmtud