Re: [tcpm] DoS attack from misbehaving receivers

> Documenting the attack is definitely a good idea, and I agree
> that it is essentially a blind ack attack (even though it is a 
> partial blindness, since *some* of the send segments reach
> the attacker).

Yes - indeed. This is kind of important, because it means that the
defences currently described in draft-azcorra-tcpm-tcp-blind-ack-dos
will not be effective.

> Single flows of over 10 Mbits being sent to a stranger over
> the wide internet can be easily flagged at many different 
> layers.

Sometimes this is not so easy - some people want to ship 10Mbps
streams to those that can receive them but do not want send them
to people for whom it will cause congestion (for example, people
providing mirror services). I guess it could be flagged by the
network, but few people want routers to send source quench messages
any more ;-)

To me it seems natural to address this at the TCP layer because it
is essentially an attack on TCP's congestion control mechanism.

> Keep in mind that *any* form of rate shaping will severely
> impact this attack because the attacker will no longer be able
> to predict the timing of tcp sequences.

There's no prediction involved in the attack that we were demoing
- it is entirely deterministic. We just send an ACK for every packet
we get, providing the sequence number is higher than the previous ACK
that we sent.

	David.

_______________________________________________
tcpm mailing list
tcpm@ietf.org
https://www1.ietf.org/mailman/listinfo/tcpm