[tcpm] AD review: draft-ietf-tcpm-syn-flood-02

[Lars Eggert <[e-mail]>]

Summary: Basically good to go.

--- COMMENTS ------------------------------------------------

INTRODUCTION, paragraph 13:
 >    This document archives explanations of the attack and
 >    common defense techniques for the benefit of TCP implementers and
 >    administrators of TCP servers or networks.

   Suggest to add "but does not make any standards-level
   recommendations."


Section 2.1., paragraph 4:
 >    Some of these techniques have
 >    become important pieces of the TCP implementations in certain
 >    operating systems, although some significantly diverge from the  
TCP
 >    specification and have not yet been standardized or sanctioned  
by the
 >    IETF process.

   s/and have not yet been/and none of these techniques have been/


Section 2.2., paragraph 6:
 >    The goal is to send
 >    a quick barrage of SYN segments from spoofed IP addresses that  
will

   "from spoofed IP addresses" - not necessarily spoofed; think botnets
   (you discuss this below)


Section 4., paragraph 0:
 >   4.  Analysis

   Part of this section discusses history - move those parts into  
Section
   2.1?


--- NITS ---------------------------------------------------

Section 2.2., paragraph 15:
 >    network.  The attack also attepts to prevent only the  
establishment

   Nit: s/attepts/attempts/


Section 2.2., paragraph 17:
 >    case, each host utilized in the attack would have to supress its

   Nit: s/supress/suppress/


Section 3.2., paragraph 1:
 >    An obvious attempt at defense is for end hosts to use a larger

   Nit: s/at defense/at a defense/


Section 3.4., paragraph 3:
 >    Measurments at one site's border router [All07] logged  
2,545,785 SYN

   Nit: s/Measurments/Measurements/


Section 3.5., paragraph 3:
 >    attack, or via adminstrative action.

   Nit: s/adminstrative/administrative/


Section 7.0, paragraph 0:
 >    way that it is from the sequence number / acknowledgedment in a  
basic

   Nit: s/acknowledgedment/acknowledgment/


Section 7.0, paragraph 1:
 >    compromises inherrent in SYN cookies is unique to the FreeBSD

   Nit: s/inherrent/inherent/


Section 7.0, paragraph 4:
 >    the passive side side's application-layer never is notified of the

   Nit: s/side side's/side's/


Appendix A., paragraph 2:
 >    number, MSS, a time counter, and the relevent addresses and port

   Nit: s/relevent/relevant/

_______________________________________________
tcpm mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/tcpm