Subject: [Stackevo] semi-workshop

From: "Byrne, Cameron" <[email-masked]>
Date: Wed, 4 Feb 2015 18:02:55 +0000

Hi,

I read your document http://www.ietf.org/blog/2015/02/semi-workshop/

UDP is 99% attack traffic on real networks. Nobody should be encouraged to use it since you will be guilty by association and subject to rate-limiting and other counter-attack methods. Please use SCTP or other new L4 instead of over-loading on the cesspool of UDP.

I do not believe your workshop was well represented by internet network operators, and consequently views the constraints and risks with UDP from a distorted lens.  The reality is that there are very very large DDoS attacks happening on my network every day, millions of packets per second, 10s of gigs -- every day.  And 100% of it is UDP, some direct UDP attacks, most is amplified reflected NTP, chargen, DNS, SNMP and UDP1900.

That said, as a tactical matter, UDP is highly constrained by stateless filters and policers and will remain this way indefinitely.

It is wholly imprudent and naive, if not reckless, for the IAB to suggest that UDP be given more effort.  The IAB instead should focus on the next generation of how SCTP or other L4 transports can be used. 

Oh, I understand you may be concerned about NATs.  In that case, go back to square one and focus on IPv6 deployment.

You will not see any meaningful process or change if you maintain this technical debt of NAT + IPv4.

--------------------
Cameron Byrne

---

From: Brian Trammell <[email-masked]>
Date: Wed, 4 Feb 2015 20:38:03 +0100

Hi, Cameron,

(speaking personally, for what that's worth)

> On 04 Feb 2015, at 19:02, Byrne, Cameron <[email-masked]> wrote:
> 
> Hi,
> 

Thanks for the interest! Please do note that the workshop page at https://www.iab.org/activities/workshops/semi/ has more information about the workshop, including the position papers discussed. We'll also have minutes out shortly.

> UDP is 99% attack traffic on real networks. Nobody should be encouraged to use it since you will be guilty by association and subject to rate-limiting and other counter-attack methods.

I'm well aware of this. Okay, I'd want to see measurements to support a 99% claim -- that seems a little hyperbolic to me -- but I'll certainly buy "the vast majority", based on the passive observations I've had access to (two national-scale networks, over the past decade or so; haven't looked today).

Indeed, one of the outcomes of the workshop is to set up coordination of better measurement of what access networks will actually pass, because the best numbers available in the literature (the most recent being the evaluation section of the HICCUPS paper, Craven et al "A Middlebox-Cooperative TCP for a non End-to-End internet, summary at slide 6 of http://www.ietf.org/proceedings/91/slides/slides-91-iab-techplenary-6.pdf) are not really representative of the Internet as a whole. Knowing what works on Planetlab and Ark is nice, but these are largely connected to academic networks, which are quite a bit more end-to-end than enterprise, residential, not to mention mobile networks.

> Please use SCTP or other new L4 instead of over-loading on the cesspool of UDP.

From an architectural standpoint, I agree with you 100%. An Internet where SCTP fails on less than, say, 1e-6 connection attempts, such that "build on SCTP" becomes a reliable option that Just Works, would be by far the preferable option.

I don't think we have that Internet.

Too many middleboxes drop what they can't mess with -- or worse, try to mess with what they can't mess with. And there's far too much misguided "security" advice out there for network operators to block packets essential for new transport features, or even packets essential for current ones (i.e., not all ICMP is "recon").

Note that the Transport Services (TAPS) WG (http://datatracker.ietf.org/wg/taps) is taking an alternate approach to this problem, using new transports when they're available and falling back when not. This approach (as, indeed, the new-transports-in-userspace-over-UDP approach we looked at in SEMI) requires application and library/API support, as well as applications that can work well with a fallback option. But we're hard at work on this approach too.

> It is wholly imprudent and naive, if not reckless, for the IAB to suggest that UDP be given more effort.  The IAB instead should focus on the next generation of how SCTP or other L4 transports can…

I would welcome any and all cooperation that the network operations community is willing to give us in making the Internet safe for new transports without encapsulation hacks to avoid path transparency issues. If you'd be able to assist us in getting hard numbers on path transparency on networks you operate, for instance, please drop me a line -- this would be extremely useful in data-driven engineering of solutions to the problem.

> You will not see any meaningful process or change if you maintain this technical debt of NAT + IPv4.

I'm a little surprised at the implication that the IAB and indeed the IETF in general is somehow less than enthusiastic about a NAT-less, v6 world. I for one was sold on SCTP-over-6 as The Way Of The Future the first time I read the appropriate chapters in the then-new edition of Stevens (this would have been fifteen years ago, now) and got into networking in part to get over my crushing disappointment that it didn't really work that way (yet).

Many thanks, and best regards,

Brian Trammell, hatless fan of end-to-end

> --------------------
> Cameron Byrne
> 
> 
> _______________________________________________
> Stackevo mailing list
> [email-masked]
> https://www.iab.org/mailman/listinfo/stackevo