Subject: Re: LLMNR and Rendezvous TTL disagreement, a modest proposal

From: Ted Lemon <[email-masked]>
Date: Tue, 24 Feb 2004 15:27:12 -0500

On Feb 24, 2004, at 1:50 PM, Paul Vixie wrote:
>> The difference is with reflection attacks. A worm sends an LLMNR 
>> request
>> to the local network, spoofing the source address of a target. With
>> TTL=255, the response to the request can bomb any site on the 
>> Internet;
>> with TTL=1, the response will only travel one hop.
>
> once again we see that there are cogent arguments to be made for both
> ttl settings, but that consensus proves elusive.  we can flipflop on
> this for many years to come, or we can find a compromise (which means
> "a solution which displeases everyone equally".)

I beg to differ.   This is not a cogent argument, because the bombing 
scenario can't happen unless all the routers on the internet are very 
carefully broken.   Furthermore, it's an irrelevant argument, because 
we've (at least, some of us have) agreed that we don't need the TTL=255 
check for multicast anyway, and it's sufficient to have it just for 
unicast.

I think we're very close to a compromise here, if the authors are 
willing to consider the proposed changes.   I don't understand why 
Christian brought up the bomb argument again, or what it has to do with 
the ongoing discussion.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Mika Liljeberg <[email-masked]>
Date: Tue, 24 Feb 2004 23:35:33 +0200

> check for multicast anyway, and it's sufficient to have it just for 

Reflection attack is a possibility if the attacker sends a spoofed query
to a multicast group of higher than link-local scope or to a broadcast
address.

	MikaL