Subject: RE: (ngtrans) DSTM addressing

From: [email-masked]
Date: Thu, 14 Sep 2000 17:29:12 +0100

-----Original Message-----
From: Hesham Soliman (EPA)
To: 'Francis Dupont'
Cc: [email-masked]
Sent: 14/9/2000 3:25 ii
Subject: RE: (ngtrans) DSTM addressing 

...
=> I am saying that. It is very hard to avoid DOS attacks... Perhaps 
it is not possible in this case? (for me the problem is open) 

Yes I agree with you but I'm trying to improve the current situation. 
I think a 50 % fix is better than 0. 
Of course a complete solution would be ideal. 

I think what you suggest (limit initial lifetime of address) is a good idea
and it will help but only up to a point as you also recognise. Even if you
assign an address for say 1 sec you actually need to wait for more than that
(X Sec) before you can reassign it. This is because if the external node
delays session initiation and you re-assign the address to someone else too
fast, the external node might communicate with the wrong internal node. An
attacker can also send you rotating DNS packets matching your assignment
lifetimes...the timing  here is critical and difficult to define...

The trick that DSTM is using for incoming connections is very similar to the
one that NAT-PT uses. It might worth having a look at RFC2766 to see how
that works. The DOS attack problem is not easy to solve here. There are a
few things you can do (in addition to your suggestion) in order to minimise
its effects but nothing I know of will completely remove the problem:

- In DNS set caching time to 0, so external nodes use the assigned address
for a single session and DNS servers do not cache it
- Limit the number of addresses you allow to by assigned for incoming
connections so you can protect outgoing traffic.
- Keep track of external nodes that make requests if possible (you might be
able to identify attackers but not easy...)

Regards
George