Re: [tcpm] New I-D (draft-mahesh-persist-timeout-00.txt)

Good point.

This particular behaviour can be detected quite easily
when compared to a well-behaved receiver. A
well-behaved TCP receiver will do receive side silly
window avoidance, and would only advertise a window
increase when at least a MSS worth of buffer space is
available (typically). 

Murali

--- Fernando Gont <fernando@gont.com.ar> wrote:

> At 03:24 p.m. 13/02/2007, you wrote:
> 
> Comments inline....
> 
> 
> >A new I-D has been posted on the IETF web site.
> >
>
><http://www.ietf.org/internet-drafts/draft-mahesh-persist-timeout-00.txt>http://www.ietf.org/internet-drafts/draft-mahesh-persist-timeout-00.txt
> >"TCP Maintenance and Minor Extensions", Mahesh
> Jethanandani, Murali 
> >Bashyam, 9-Feb-07,
> <draft-mahesh-persist-timeout-00.txt> Comments are
> welcome.
> 
> What if I advertise a window of 1, instead?
> 
> Or, what if I advertise a window of zero, then
> before you abort the 
> connection I advertise a window of a few bytes, and
> then I go back to 
> advertising a window of zero (and so on)?
> 
> I think it is interesting to find a workaround for
> this type of 
> resource exhaustion attack (as well as for Netkill,
> etc.).
> 
> However, I think the heuristics will need to be more
> complex. If not, 
> it will be easy (and cheap) for the attacker to fool
> the proposed 
> counter-measures. (the examples above are some
> possible ways to do so).
> 
> Kindest regards,
> 
> -- 
> Fernando Gont
> e-mail: fernando@gont.com.ar || fgont@acm.org
> PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE
> A9EF D076 FFF1
> 
> 
> 
> 
> 
> _______________________________________________
> tcpm mailing list
> tcpm@ietf.org
> https://www1.ietf.org/mailman/listinfo/tcpm
> 

____________________________________________________________________________________
8:00? 8:25? 8:40? Find a flick in no time 
with the Yahoo! Search movie showtime shortcut.
http://tools.search.yahoo.com/shortcuts/#news

_______________________________________________
tcpm mailing list
tcpm@ietf.org
https://www1.ietf.org/mailman/listinfo/tcpm