Re: [quicwg/base-drafts] Deduplication window suggested by RFC 4303 is insufficient (#3692)

[Martin Thomson <[e-mail]>]

I agree that RFC 4303 is showing its age here.  32 packets is probably woefully inadequate here.  But there is an additional insight that is important: you need to drop all packets older than the oldest packet you are individually tracking or you are vulnerable to duplication attack.  It's a little awkward restating that.

It's not obvious that you need to allow for an increase of half of the difference between the current min_rtt and some maximum value either, so it is worth saying that.  Noting that the collective packet rate on all paths affects any limit is similarly non-intuitive.

The nice thing about this is that the most obvious packet-tracking structures (aside perhaps from those that are subject to DoS) are not susceptible to this problem.  For instance, many people are tracking ranges and limiting the total number of ranges.  If you do that, you only run into problems after the number of slow probes sent within one of these extra-long round trip times exceeds the number of ranges the receiver is tracking.  Most implementations are tracking more ranges than there are packets in an initial congestion window, so you won't get issues.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3692#issuecomment-633404227