Re: [Tsvwg] SCTP and ICMP Protocol Unreachable

[Stephane Chazelas <[e-mail]>]

On Fri, Sep 22, 2006 at 04:13:32AM -0600, Brian F. G. Bidulock wrote:
> Stephane,
> 
> Stephane Chazelas wrote:        (Fri, 22 Sep 2006 10:51:57)
> > 
> > http://www.ietf.org/internet-drafts/draft-ietf-tsvwg-sctpthreat-01.txt
> > 
> > 5) is taken care of by the change to the RFC that every address
> > must be confirmed first. So that only heartbeats are sent to the
> > victims
> 
> Well, no.  That was Michael's point (I believe): if you only mark the
> destination unusable you will be sending another nonce-HB to the next
> destination soon.  If you aborted the association in response to the
> ICMP, only one nonce-HB would be sent.  Thus you reintroduce the
> amplification if you mark destinations or ignore ICMP.
[...]

Yes, but in that case the next HB is only sent after a timeout
(getting longer and longer) while in the 6) case, because the
association is aborted immediately, the attacker is able to
cause another HB to be sent straight away.

Another question is: what would be the motive of the attacker?
Can he clog a network that way? A HB would be rather harmless to
the victim, especially if it doesn't support SCTP.

Best regards,
Stephane