Re: [rtcweb] UDP transport problem

[Harald Alvestrand <[e-mail]>]

On 02/14/2014 07:54 PM, Cb B wrote:
> On Fri, Feb 14, 2014 at 10:24 AM, Harald Alvestrand
> <[e-mail]> wrote:
>> On 02/14/2014 03:42 PM, Cb B wrote:
>>>> It's especially depressing in that we put significant effort into
>>> reducing the likelihood that WebRTC could be used for DDoS attacks.
>>>> I will note that blocking UDP (or massively-rate-limiting it) will
>>> have all sorts of nasty effects on all forms of VoIP.  TCP-entrained
>>> VoIP can evade that, but at a serious cost to call quality.  Surely
>>> the operators know this.
>>> Agreed on all points. My view is one related to the basic requirement
>>> of keeping the network up.  I hope i have provided enough reference
>>> points to make the magnitude of the problem clear as well as how
>>> history has shown protocols get blocked (smtp)
>>>
>> This SMTP example doesn't match what I've seen happen.
>>
>> SMTP is not blocked by any backbone service provider I know of.
>>
>> Outgoing SMTP on port 25 is commonly blocked by firewalls that think
>> they don't have servers behind them (hotels are notorious in this
>> aspect). That's why the submit port is popular (and deployed with
>> authentication). The main concern isn't DDOS attacks, it's being blamed
>> for spam.
>>
> Spam is a type of attack.  It is an L7 attack as opposed to a volume attack.
>
>
> The largest broadband ISP in the USA blocks port 25, i provided this
> info in my first email.
>
> http://customer.comcast.com/help-and-support/internet/email-port-25-no-longer-supported/

I believe this is consistent with what I said. They block it *for
residential customers*.

That's why I said "by backbone providers" above.

If port 25 was blocked by backbone providers, we would not be having
this conversation in this medium; from your message:

Received: from mork.alvestrand.no ([127.0.0.1])
	by localhost (mork.alvestrand.no [127.0.0.1]) (amavisd-new, port 10024)
	with ESMTP id l5OItdTpHJNZ for <[e-mail]>;
	Fri, 14 Feb 2014 19:54:12 +0100 (CET)
X-Greylist: domain auto-whitelisted by SQLgrey-1.8.0-rc2
Received: from mail-wg0-f50.google.com (mail-wg0-f50.google.com [74.125.82.50])
	by mork.alvestrand.no (Postfix) with ESMTPS id D71377C4CF1
	for <[e-mail]>; Fri, 14 Feb 2014 19:54:11 +0100 (CET)
Received: by mail-wg0-f50.google.com with SMTP id z12so676422wgg.17
        for <[e-mail]>; Fri, 14 Feb 2014 10:54:07 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20120113;
        h=mime-version:in-reply-to:references:date:message-id:subject:from:to
         :cc:content-type;
        bh=uOHldLGex53bmiWfJEdhgiY7mkII6sbilbQC8KWLQBI=;
        b=jkmpcR1j1p4IBKmFsuKH1r7thWkWzUfakYB1l0aCvWkCB3r6UwGkxyS8QZSYfrcLZL
         1yR20Mgz/sHeU0Sqn6GGSIwDVSSmG/arGHcITQuhUJ/qP99huNVTNArKtdlxb6iQArW8
         WiT03gtCm74rfIWcbMqrnV0KxBZVwY0UcyCc1zcrPx7ykqEI2trkIdp/xj517VgAAU7i
         YjtLZPqHJgy0kp9jenRgFfHqOA6KTOaCowOQmS/tdSUgJOoK16Up+HWbI2ACCVXDocJW
         3LqGlj0TnzIdKnUgvNNqBikK7GAF71Hra8FkkFmcsrZLjjY4PYBAnzdUIfmydj29zMIs
         Mviw==
MIME-Version: 1.0
X-Received: by 10.194.202.230 with SMTP id kl6mr7582617wjc.9.1392404046219;
 Fri, 14 Feb 2014 10:54:06 -0800 (PST)


The occurences of the word "SMTP" in those header fields should tell you
something.

>
>> I've not seen any report of a DDOS attack that used port 25 for a
>> traffic-volume-based attack (although intentional or unintentional DDOS
>> attacks on mail servers are too common to care about).
>>
>> Given that I still haven't seen a report that leads me to belive we'll
>> ever see a proposal that seriously proposes blocking all UDP traffic on
>> the Internet - I continue to disbelieve the premise, so it's not
>> surprising that I disagree with the conclusion.
>>
> That's fine.  It is not my goal to block UDP or save WebRTC.  I am
> just submitting information that i have and connecting the dots that
> are in front of me.  The future may show that i am too pessimistic or
> not enough.
>
> CB
>
>> --
>> Surveillance is pervasive. Go Dark.
>>
>> _______________________________________________
>> rtcweb mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/rtcweb


-- 
Surveillance is pervasive. Go Dark.