Re: [tcpm] DoS attack from misbehaving receivers

I have thought abou this attack and had some spirited discussion with
Rob on the topic.  I am not greatly worried about it myself.

  + It is pretty easy to detect this attack (in fact there is a footnote
    in the paper that says the author's experiments were detected by
    their network provider!).  It is fairly easy to see that more data
    is being ACKed than is being actually received.

  + Slammer was a one packet UDP fire and forget situation.  It sourced
    traffic as fast as the attached link could support---no control of
    any kind.  (Other worms have had this property, as well.)  We did
    not see a melting core.  So, I am not quite sure I am worried about
    a botnet of optack-ing boxes coaxing something to happen that has
    not already happened.

  + If we think this is a problem that needs a solution, we should think
    about how to do so without hacking things like changing the sending
    order.  (E.g., a generalized nonce (a la Savage) or something.

My two bits ...

allman