RE: [tcpm] DoS attack from misbehaving receivers

> > But is it not correct that the same attack could be launched
> > from a botnet just as effectively even without faking acks?
> > Until typical home computers are more secure from being drafted
> > into a botnet is there a real benefit from this counter-measure?
> 
> A botnet of sufficient size, maybe.  An open question (read: subject
of
> my current research) is how much traffic is required to overcome
> Internet
> backbone links.  The reason for concern with the OptAck attack is that
> the amplification factors are large (~1600x and higher from the
paper),
> which reduces the size of the botnet required to cause significant
> damage.

I have witnessed distributed DOS attacks generating several Gbps of
traffic, and that was a couple of years ago. I have also witnessed DOS
attacks implemented by simply opening multiple TCP connections. The
attack software started several threads, and in each thread a loop would
keep loading a particular web page. That actually gives a lot of
amplification, since the size of the HTTP request is only a fraction of
the size of the response. There was no attempt to hide the origin of the
attack, spoof the IP address, hack the TCP stack, or any of that. These
particular attacks were trying to bring down a web site, but similar
attacks could easily target a particular link in the infrastructure.

-- Christian Huitema

_______________________________________________
tcpm mailing list
tcpm@ietf.org
https://www1.ietf.org/mailman/listinfo/tcpm