Subject: RE: [Fwd: [Saad] Some initiating thoughts...]

From: "Harrington, David" <[email-masked]>
Date: Thu, 23 Oct 2003 09:50:47 -0400

Hi Erik,

Typically, a DoS attack will be sourced from a host. Having the host be
responsible for advising the network how to prioritize packets is akin
to locking the henhouse to prevent fox attacks and then giving the fox
the key.

I believe the right place to apply policy is in the access switch. The
operators should know what types of traffic are likely to be generated
by the host, based on the role of the host in the organization, and can
preset policies to prioritize the desirable traffic. To handle mobility,
and finer-grained role-based policies, the operator can base the
expected traffic and priorities on the user's identity, qualified by
location and other factors.

dbh

> -----Original Message-----
> From: Erik Nordmark [mailto:[email-masked]] 
> Sent: Thursday, October 23, 2003 7:37 AM
> To: James Kempf
> Cc: Erik Nordmark; Leslie Daigle; [email-masked]; 
> [email-masked]
> Subject: Re: [Fwd: [Saad] Some initiating thoughts...]
> 
> 
> > But much of the appeal for firewalls (and some people 
> extend this to limited
> > scope addressing, but I'm not sure if the extension is 
> really necessary)
> > lies in their ability to limit DoS attacks. DoS attacks are 
> essentially
> > attacks on a network and I have some trouble seeing how end 
> to end security
> > between two devices can limit a DoS attack. Maybe I am 
> missing something,
> > however.
> 
> Yep - end2end security isn't sufficient if you have a wide range of
> network bandwidth (and too some extent also CPU capacity to deal
> with network packets) across the network.
> 
> Some approaches to deal with DoS is thus needed.
> 
> I don't know if anybody is working on host-assisted approaches.
> I can imagine interesting approaches like hosts on slow links sending 
> "priority lists" upstream (to specify the relative priority 
> of packets - 
> based on a class description - that are destined towards the 
> host) as one
> way of being able to cope with DoS flooding attacks.
> 
>   Erik
> 
> 
> _______________________________________________
> Saad mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/saad
> 

_______________________________________________
Saad mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/saad

---

From: Melinda Shore <[email-masked]>
Date: Thu, 23 Oct 2003 10:01:41 -0400

On Thursday, October 23, 2003, at 09:50 AM, Harrington, David wrote:
> I believe the right place to apply policy is in the access switch.

I believe that *a* right place to apply policy is in
the access switch.  I don't see how the user's identity
is sufficient to be able to answer the question of
whether or not a particular stream of data should be
afforded various sorts of treatment, etc.  It may be
sufficient for admission control, though, and it
would certainly be a substantial improvement over
current common practice.

Melinda

---

From: Erik Nordmark <[email-masked]>
Date: Thu, 23 Oct 2003 16:32:06 +0200 (CEST)

> to locking the henhouse to prevent fox attacks and then giving the fox

David,

Your comment would make sense if I had suggested doing this for
packets *sent from the host*. I did not. I was talking about
packets being delivered *towards the host*.

And only in terms of a *relative priority* compared to other packets
sent towards the same IP address.

  Erik