Re: Entropy in headers for connection identification at a stateful firewall

[Töma Gavrichenkov <[e-mail]>]

Hi Mikkel,

Thank you for your input,

> If a middlebox experience excessive load on some 5-tuples or connection ID’s it can issue a RETRY on new connections. If a client gives up a connection due to timeouts etc. it might try to create a new connection. This new connection might land on the same problematic middlebox. This middlebox then issues a RETRY that informs the client to try to connect to another server which hopefully lands it a on path that is not subject to attack. A RETRY only has one level, so if the new location is also under attack, the client must abort the connection attempt altogether and start over from scratch. It might then get lucky for example by choosing a random IP from a DNS record.

Well, like I said, there wouldn't be any problem with the middlebox,
it would be able to handle virtually any possible load. It's the
client who wouldn't.

RETRYing on connection is something I also thought of, but in case of
latency- and jitter-specific applications (AV streaming, gaming, etc.)
a constant connection retry could actually be an attacker's purpose.

As a side note, usually we don't have any control on either the client
or, especially, the server. We don't know if it deploys one IP address
to DNS or more. In theory, a solution might be to set up a proxy on
the path, but in reality it's too complicated and, ironically, would
severily harm the user's privacy.