Re: I-D.ietf-v6ops-cpe-simple-security-09

[Mark Townsley <[e-mail]>]

On 3/20/10 8:53 PM, Fred Baker wrote:
> On Mar 20, 2010, at 12:40 PM, Mark Townsley wrote:
>
>    
>> Rate-limiting unsolicited inbound connections rather than rejecting them provides greater end-to-end transparency while still providing protection against address and port scanning attacks as well as overloading of slow links or devices within the home.
>>      
> SIlly question. Why do you believe that? An address or port scanning attack is not intended to overload a network, it is intended to find an address port that can be used or attacked.
The sentence is referencing two different things. One, the possibility 
that uninvited packets might overload some device or slow link 
(something I consider unlikely, but has been identified as a concern by 
some), the other is, indeed, designed to make blind port and address 
scanning less likely to succeed in a given amount of time.

- Mark
>   Making the scan take more time doesn't prevent it from reaching its target. In what way does rate limiting an address or port scan provide protection?
>
> http://www.ipinc.net/IPv4.GIF
>
>
>