Re: [Tsvwg] Re: [tcpm] Revision ofdraft-larsen-tsvwg-port-randomization

[Joe Touch <[e-mail]>]

Caitlin Bestler wrote:
> 
> On Jul 26, 2007, at 9:03 AM, Murari Sridharan wrote:
> 
>> Aren't these directly related? Port randomization in general is good
>> and agreed not all scenarios exhaust ports but attacks typically are
>> on loaded servers and proxies, and if ports get exhausted in these key
>> scenarios where such a draft makes most sense, what's the point of
>> randomization?
>>
>>
> Port randomization is admittedly a limited solution, but it is a fully
> compatible solution.
> More general solutions, while theoretically better, will likely have
> deployment barriers
> that will actually make them even more limited as a solution.

Port randomization isn't really a 'solution' to port exhaustion; it's a
BCP-ish recommendation that's like ISN-randomization. It helps a bit and
it's low cost.

Port exhaustion, BTW, also can mean two things:
	a- we need more ports for services
	b- it's too easy to scan all port pairs to attack

Portnames and/or tcp-x2 (I think that's what Mark called it) address the
first issue. The second is, IMO, better addressed with proper security,
rather than haystack-hiding of a needle.

Joe

-- 
----------------------------------------------------------------------
Joe Touch                Sr. Network Engineer, USAF TSAT Space Segment
               Postel Center Director & Research Assoc. Prof., USC/ISI