[tcpm] New I-D

A new version of an I-D has been posted on the IETF web site.

http://www.ietf.org/internet-drafts/draft-mahesh-persist-timeout-02.txt
"TCP Maintenance and Minor Extensions", Mahesh Jethanandani, Murali Bashyam, 27-Oct-07, <draft-mahesh-persist-timeout-02.txt> 

Abstract

   This document describes how a connection can remain infinitely in
   persist condition, and its Denial of Service (DoS) implication on the
   system, if there is no mechanism to recover from this anomaly.

Summary:
    In this version of the draft, we have documented our experiment 
using a simple user level program to create the DoS scenario. The tests 
were run against both Apache and IIS HTTP servers. The test was run on a 
larger scale in the lab environment, where we were able to document the 
behavior of the servers. The test was then run against public and well 
known sites but on a smaller scale. Sniffer traces were captured to see 
the behavior of the connections.

Our observations were that of the three well known public sites 
exhibited the DoS scenario. While site A had some mitigation technique 
in place, it was fairly easy to beat that. Site B and C had no 
mitigation in place and are currently vulnerable to the DoS attack.

Solution:
The draft documents some suggested solutions and describes why they are 
better than any of the techniques out there. In particular it talks 
about UTO and why UTO cannot solve this problem. It also talks about the 
role of applications and how they can help.

Comments are welcome.

/mahesh

_______________________________________________
tcpm mailing list
tcpm@ietf.org
https://www1.ietf.org/mailman/listinfo/tcpm