Subject: RE: (ngtrans) DSTM addressing

From: "Hesham Soliman (EPA)" <[email-masked]>
Date: Fri, 15 Sep 2000 01:25:55 +1100

In your previous mail you wrote:

=> can you send *only* the text version (no HTML please)?

Sorry, forgot that. I hope this is working now.

=> I am saying that. It is very hard to avoid DOS attacks... Perhaps
it is not possible in this case? (for me the problem is open)

Yes I agree with you but I'm trying to improve the current situation. 
I think a 50 % fix is better than 0. 
Of course a complete solution would be ideal.

Cheers,
Hesham

---

From: Francis Dupont <[email-masked]>
Date: Thu, 14 Sep 2000 17:10:30 +0200

=> not yet...

=> I am afraid that for DOS attacks a 50% known (*) fix is not enough.

=> the only solution I know is to restrict the scenario 2 but this makes
it far less useful then we temporary discarded it.

Regards

[email-masked]

PS *: known by attackers of course. They can for instance:
 - flood the AIIH server by requests (if legitimate requests can't be
   quicky recognized you are dead).
 - simulate long term connections in order to get a long lifetime
   (ie. you need to use something like IPsec in order to kill junk
    connections and to provide some feedback to the AIIH server).
PPS: I'd like to get George's ideas about scenario 2 deployment. For instance
if the requests may come only from an internal node and/or through an AAA
machinery then DOS problems can be controlled. I know mobile phone
operators like/need AAA (for the last A, sorry :-).