Re: [tcpm] PoC for draft-moncaster-tcpm-rcv-cheat-02

On Wed, Mar 26, 2008 at 03:41:12PM -0400, Caitlin Bestler wrote:
> I'd rephrase that as:
> 
> b) people who believe the attack is practical, but that the problem is
> an
>    application layer problem that should be solved at the application
> layer
>  -- and especially not by transport layer solutions that would have a
>     negative impact on honest connections.

I would call this a different camp all together, mostly because it's
one I least understand the rationale for.  Maybe you could reiterate
your points for me (off list, if you think this issue is dead)?

I feel like this view comes from a misunderstanding of the attack.  In
my view, the goal of the attack is not to saturate the first hop of a
single victim.  Instead, the attacker's goal is to fool many victims in
parallel into saturating their shared access and backbone links by the
*aggregate traffic*.  Thus, no one victim is sending abnormally fast,
but the aggregate level of traffic ( summed across victims) is
sufficient to cause DoS.  To paraphrase, this is an attack against the
network not an individual.  

So, when one views the attack from this standpoint, I don't see how
application level rate limits (which, IIRC, is what you were proposing)
would stop this attack: no one victim is sending at an excessive rate.

- Rob
.
_______________________________________________
tcpm mailing list
tcpm@ietf.org
https://www.ietf.org/mailman/listinfo/tcpm