Re: [tcpm] New I-D posted : draft-moncaster-tcpm-rcv-cheat-00

Hi,

On Tue, 20 Feb 2007, Rob Sherwood wrote:

> Should people decide that this two phases approach is preferable, it
> might be possible to simplify the first phase test as follows.  Rather
> then reordering segments N-1,N,N+1,..,N+D to N-1,N+1,..,N+D,N as Toby
> et. al suggest, it might be better to more frequently perform this test
> with D=1, (i.e., simply swap the order of two sequential segments) and
> after some threshold number K failures, apply the second phase randomly
> skipped segment test.

Perhaps I misunderstand, but is it not necessary to have variation in D of
at least 
        0 < D < 4
for the attack to be definitively prevented?

The "lazy ack" form of the attack just omits duplicate acks in order that a
loss is never detected.  If the above were implemented with D=1 it appears
that an attacker could always send the first duplicate ack in response to a
missing packet but omit the second or third duplicate ack.  This would seem
to allow the attack to continue but also pass the N-1,N+1,N test.

I guess if lots of packets are being lost as part of the attack this kind
of precision may be impossible on the part of the attacker so maybe the
above is not so important.

Gavin

_______________________________________________
tcpm mailing list
tcpm@ietf.org
https://www1.ietf.org/mailman/listinfo/tcpm