RE: [tcpm] New I-D (draft-mahesh-persist-timeout-00.txt)

Yep, on a related note, some TCP stacks shrink windows, window shrinking
is used as a convenience tool in some cases :-) We probably need to deal
with such cases as well, since the robustness principle allows it.

-Anantha 

> -----Original Message-----
> From: MURALI BASHYAM [mailto:murali_bashyam@yahoo.com] 
> Sent: Wednesday, February 14, 2007 12:14 AM
> To: Fernando Gont; Mahesh Jethanandani (mahesh)
> Cc: tcpm@ietf.org
> Subject: Re: [tcpm] New I-D (draft-mahesh-persist-timeout-00.txt)
> 
> Good point.
> 
> This particular behaviour can be detected quite easily when 
> compared to a well-behaved receiver. A well-behaved TCP 
> receiver will do receive side silly window avoidance, and 
> would only advertise a window increase when at least a MSS 
> worth of buffer space is available (typically). 
> 
> Murali
> 
> --- Fernando Gont <fernando@gont.com.ar> wrote:
> 
> > At 03:24 p.m. 13/02/2007, you wrote:
> > 
> > Comments inline....
> > 
> > 
> > >A new I-D has been posted on the IETF web site.
> > >
> >
> ><http://www.ietf.org/internet-drafts/draft-mahesh-persist-tim
> eout-00.tx
> >t>http://www.ietf.org/internet-drafts/draft-mahesh-persist-ti
> meout-00.t
> >xt
> > >"TCP Maintenance and Minor Extensions", Mahesh
> > Jethanandani, Murali
> > >Bashyam, 9-Feb-07,
> > <draft-mahesh-persist-timeout-00.txt> Comments are welcome.
> > 
> > What if I advertise a window of 1, instead?
> > 
> > Or, what if I advertise a window of zero, then before you abort the 
> > connection I advertise a window of a few bytes, and then I 
> go back to 
> > advertising a window of zero (and so on)?
> > 
> > I think it is interesting to find a workaround for this type of 
> > resource exhaustion attack (as well as for Netkill, etc.).
> > 
> > However, I think the heuristics will need to be more 
> complex. If not, 
> > it will be easy (and cheap) for the attacker to fool the proposed 
> > counter-measures. (the examples above are some possible ways to do 
> > so).
> > 
> > Kindest regards,
> > 
> > --
> > Fernando Gont
> > e-mail: fernando@gont.com.ar || fgont@acm.org PGP Fingerprint: 7809 
> > 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1
> > 
> > 
> > 
> > 
> > 
> > _______________________________________________
> > tcpm mailing list
> > tcpm@ietf.org
> > https://www1.ietf.org/mailman/listinfo/tcpm
> > 
> 
> 
> 
>  
> ______________________________________________________________
> ______________________
> 8:00? 8:25? 8:40? Find a flick in no time with the Yahoo! 
> Search movie showtime shortcut.
> http://tools.search.yahoo.com/shortcuts/#news
> 
> _______________________________________________
> tcpm mailing list
> tcpm@ietf.org
> https://www1.ietf.org/mailman/listinfo/tcpm
> 

_______________________________________________
tcpm mailing list
tcpm@ietf.org
https://www1.ietf.org/mailman/listinfo/tcpm