Subject: RE: [MMUSIC] RTP denial of service

From: "Hearty, John" <[email-masked]>
Date: Wed, 2 Jul 2003 10:49:28 -0600

My security knowledge is weak, and I would like some help understanding
why the following from the draft is true:

There
   is no requirement that the calls come from unauthenticated sources.
   The attack can be launched even if the device requires
   authentication. Of course, authentication might provide some amount
   of traceability.

Wouldn't it be more difficult to launch the attack if authentication was
required?  I would think RTP would not start sending if the original
request could not be authenticated.

John

> -----Original Message-----
> From: Jonathan Rosenberg [mailto:[email-masked]]
> Sent: Tuesday, July 01, 2003 11:16 PM
> To: [email-masked]
> Subject: [MMUSIC] RTP denial of service
> 
> Folks,
> 
> I'd like to draw your attention to the following I-D that I submitted
> recently:
> 
> http://www.ietf.org/internet-drafts/draft-rosenberg-mmusic-rtp-
> denialofservice-00.txt
> 
> This draft describes a denial-of-service attack using RTP. This attack
> can be launched using any protocol that uses an offer/answer-like SDP
> exchange, including SIP and RTSP. The draft also discusses ICE as a
> solution to the problem.
> 
> Comments welcome.
> 
> Thanks,
> Jonathan R.
> 
> --
> Jonathan D. Rosenberg, Ph.D.                600 Lanidex Plaza
> Chief Technology Officer                    Parsippany, NJ 07054-2711
> dynamicsoft
> [email-masked]                     FAX:   (973) 952-5050
> http://www.jdrosen.net                      PHONE: (973) 952-5000
> http://www.dynamicsoft.com
> 
> 
> 
> _______________________________________________
> mmusic mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/mmusic

_______________________________________________
mmusic mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mmusic