RE: [tcpm] DoS attack from misbehaving receivers

Rob Sherwood wrote:
> I guess I should probably jump in here somewhere :-)
> 
> On Thu, Jan 11, 2007 at 12:00:59PM -0800, Caitlin Bestler wrote:
>> The proposed test for a non-compliant receiver would seem to require
>> that the sender be non-compliant itself.
> 
> I'm not sure I understand this comment.  Part of the utility
> of the solution is that unmodified receivers can communicate
> with senders that randomly skip segments, because segment
> reordering and dropping is already handled by TCP.
> 

Having the sender skip segments will indeed detect a non-compliant
receiver that acks segments that were never sent. But sending
non-contiguous TCP segments is itself not compliant.

> 
>> For many of the applications cited, wouldn't a more general solution
>> be to apply connection-specific rate limiters at the sender (in the
>> stack or at the application layer)?
> 
> As mentioned in the paper, rate limiting does not prevent the attack.
> The attack is for many servers to send a small amount of TCP
> unfriendly traffic into the network, which results in
> significant traffic in aggregate.  Reducing the rate of
> traffic at any one server only causes the attacker to target
> more servers.
> 

You can generate a large amount of traffic simply sending small
requests that generate large responses and then bit-bucketing
the results. If you are doing so from a botnet you can even
actually receive all of the segments in the distributed clients
before dropping the segments.

Before endorsing a counter-measure that calls for what was
previously non-compliant behavior there should be a showing
that the problem being solved is indeed severe and unique.

If my understanding is correct, the problem is that an attacker
can simulate reception of more material than their actual local
link can support, and thereby trick a large group of senders
into saturating *their* local links and/or intermediate segments.

But is it not correct that the same attack could be launched
from a botnet just as effectively even without faking acks?
Until typical home computers are more secure from being drafted
into a botnet is there a real benefit from this counter-measure?

Having transmitters engage in non-compliant behavour in order
to catch cheaters is a slippery slope best avoided.

_______________________________________________
tcpm mailing list
tcpm@ietf.org
https://www1.ietf.org/mailman/listinfo/tcpm