Re: [tcpm] Congestion control in face of ICMP unreachable messages

On 2007/08/17  , at 18:41, Joe Touch wrote:

> AFAIK, congestion control response to in-band messages (ACKs) and
> timeouts (implied loss, as TCP interprets it), as well as to some new
> fields (ECN, etc.) which are carried in the same packets.
>
> Reactions to external congestion signals - ICMP source quench  
> (which has
> been informally deprecated a while ago, but has not been documented as
> such yet) or otherwise - would constitute another opportunity for a  
> DOS
> attack, and seem like a bad idea to encourage.
I am note sure your security concerns really apply :) If the bad user  
controls the forwarding node, there is no need to rely on ICMP  
message to cause harm. Instead, just dropping random segments would  
do the job. If the bad user is off the forwarding node, she would  
need (as usual) guess port and sequence numbers. If she is able to  
guess right, she might as well opt to send forged ACK dupacks to  
cause harm, or for an ECN capable transport just one ECE marked ACK.

Overall, it seems to me that there don't arise additional attack  
opportunities if there was congestion control on ICMP messages.

But maybe I am missing something?

Thanks again,
Daniel

_______________________________________________
tcpm mailing list
tcpm@ietf.org
https://www1.ietf.org/mailman/listinfo/tcpm