Re: [tcpm] SYN/ACK Payloads, draft 01

On Fri, Aug 15, 2008 at 9:56 AM, Caitlin Bestler
<Caitlin.Bestler@neterion.com> wrote:
> If this were to move forward, the Security Considerations would need
> to document the amplification attack, and probably have SHOULD language
> about a default maximum packet size.

The 01 draft says this in the security considerations:

"  Any payload in a SYNACK packet must be as frugal as possible since a
   host will be transmitting it to an unconfirmed address.  If a 40 byte
   frame could elicit a 1500 byte reply to an attacker controlled
   address, this would be readily used to hide and amplify distributed
   denial of service attacks."

> But this is probably not something that the TCP stack should enforce.
> There are many situations where the system administrator would have
> valid reasons for knowing that a DoS was already blocked by other means.

You're correct here, the current MUST should be downgraded to a
SHOULD. Implementations can make the best decision here.

As for it moving forward, I don't feel that I would ever get consensus
for the current design. (Although I don't really know how these things
work, I believe that's required.) I shall ponder other means this
weekend, but a quick discussion amongst those who (ab)use TCP stacks
for our internal networks didn't come up with anything.

Cheers

AGL

-- 
Adam Langley agl@imperialviolet.org http://www.imperialviolet.org
_______________________________________________
tcpm mailing list
tcpm@ietf.org
https://www.ietf.org/mailman/listinfo/tcpm