Re: [tcpm] DoS attack from misbehaving receivers

Rob Sherwood wrote:
>> Before endorsing a counter-measure that calls for what was
>> previously non-compliant behavior there should be a showing
>> that the problem being solved is indeed severe and unique.
> 
> Agreed.  This is the crux of the discussion: is this attack severe
> enough to motivate the admittedly invasive change to the TCP stack.

Yep.

>> If my understanding is correct, the problem is that an attacker
>> can simulate reception of more material than their actual local
>> link can support, and thereby trick a large group of senders
>> into saturating *their* local links and/or intermediate segments.
> 
> This is mostly correct.  The true concern is that *backbone* links,
> not just local links, will be saturated, bringing about, as the title
> suggests, Internet-wide congestion collapse.  It is this concern that
> I feel motivates the need to change the specification.

The links with heavily aggregated traffic from local or regional ISPs up 
to the tier 1 ISPs are almost always bandwidth capped, and are almost 
always purchased in such that they are able to carry "just enough" 
traffic -- that is, it's pegged for at least some of the time.  (Who 
wants to pay for more than they use?)  The core of the Internet today is 
provisioned to handle the load.  It seems to me the threat of 
Internet-wide congestion collapse is a bit overstated these days.  (This 
also applies to recent congestion control discussions.)

I could see this attack as being effective at saturating something like 
a university's access link where a small number of well-connected 
servers could severely congest it.  However, in my experience, server 
and network admins are very reluctant to run any sort of service that 
will stream arbitrary amounts of data as fast as they can.  (I've 
sometimes tried to get such services made available for measurement 
purposes.)

The defense proposed in the paper is pretty cool, but implementing it 
and running it on a production machine would make me a bit nervous.  If 
this were a significant problem, you could always turn on bandwidth caps 
in the server application or in the kernel's networking system.  This 
would probably be my favored approach.  In reality, I've never heard of 
this attack being perpetrated in the wild, while DDOS is quite common.

   -John

_______________________________________________
tcpm mailing list
tcpm@ietf.org
https://www1.ietf.org/mailman/listinfo/tcpm