[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Re[2]: [Asrg] Re: ISPs and bigger fish
> Now let me play the other side of the equation just a bit... I've
> done some work on a dynamic squelch propagation protocol (DSQP) that
> would change this equation a bit.
> Essentially, the recipient of any kind of unwanted packet would be
> given the ability to send a squelch request packet back through the
> network toward the apparent transmitter of that packet.
Unfortunately, anyone, regardless of traffic received, has the ability
to send forged squelches.
Zombie armies attack with squelches -> instant DoS, whether by blocking
more than the individual hosts squelching or by overflowing the
router's capacity to block /32s.
> DSQP is best implemented in UDP.
...?? Whyever not ICMP? It's exactly the sort of thing ICMP is there
for, and it avoids issues that arise with UDP (like reserving a port
number, and teaching intermediate routers to pry into UDP packets).
> Since the scheme is such that no recipient can request a source
> squelch for any other recipient the system is inherently secure.
> Specifically, I can only request that you not send packets to me. I
> cannot request that you not send packets to any third party.
You can if my upstream's border router does the "too many squelches and
you're disconnected" thing you suggested, or even when it hits its
limit of /32s it can squelch in response to the zombie army attack.
> The DSQP system would be completely automated so that once DSQPs stop
> arriving at routers along the network path the source again becomes
> unhindered. This is a matter of establishing reasonable time-out
> values and policies.
Establishing any kind of state in the core for significant numbers of
(sender,recipient) pairs is hopelessly impractical - which is not to
say that it's worthless to consider implementing at or near the edge,
just that the core will need a lot more RAM before much can be done
with it there.
Also, in the presence of networks that don't do proper anti-forgery
filtering - and we know such lack of filtering is widespread - I can
DoS your connectivity to a DSQP-using site by sending it squelches
forged to appear to come from you.
/~\ The ASCII der Mouse
\ / Ribbon Campaign
X Against HTML mouse at rodents.montreal.qc.ca
/ \ Email! 7D C8 61 52 5D E7 2D 39 4E F1 31 3E E8 B3 27 4B
_______________________________________________
Asrg mailing list
Asrg at ietf.org
https://www1.ietf.org/mailman/listinfo/asrg