Re: ttl and authentication

[Dave Katz <[e-mail]>]

On Feb 24, 2005, at 12:00 AM, Pekka Savola wrote:

> The concern is which is done first: TTL check or authentication check.
>
> Compare the situation to BGP with MD5.  Folks can easily DoS a router 
> by sending bogus MD5-signed BGP packets to spend all the CPU's 
> computational resources.  Using TTL=255 check _first_ prevents this 
> particular attack vector, except from the on-link neighbors.
>
> The same argument seems to apply here.  Speaking as an operator who's 
> using BFD, I will not be happy if the TTL is not checked first as this 
> opens a resource exhaustion attack vector which could be easily 
> prevented.

I guess I would counter that if the TTL check is the only thing 
protecting your infrastructure, then you have bigger problems.  
Filtering at the edge of your network has got to be the first line of 
defense.  Certainly there have got to be similar opportunities to hose 
things with other protocols for which a TTL check will not help.

--Dave