Subject: RE: [Tsvwg] Re: Last Call: Robust ECN Signaling with Nonces to Experimental

From: "Spencer Dawkins" <[email-masked]>
Date: Wed, 8 Jan 2003 14:29:43 -0600

Yeah, what Neil said. 

In addition, I Would Have Thought that an attacker who couldn't spoof an ACK (or RST) would just be SYN-flooding anyway. I'm not sure why we're not holding ECN Nonces to this standard. 

Do we think third-party attackers would rather twiddle with TCP sending rates than (1) overwhelm a network segment entirely via flooding, or (2) RST TCP connections?

Sounds like an awfully polite attacker to me - or is that the answer (twiddling with TCP sending rates would be less likely to set off intrusion detection systems)?

Spencer

> -----Original Message-----
> From: Neil Spring [mailto:[email-masked]]
> Sent: Wednesday, January 08, 2003 1:19 PM
> To: [email-masked]
> Subject: Re: [Tsvwg] Re: Last Call: Robust ECN Signaling with 
> Nonces to
> Experimental
> 
> 
> On Wed, Jan 08, 2003 at 12:53:29PM -0500, Mark Allman wrote:
> > We agree that eavesdroppers can exploit ECN and the ECN
> > nonce as a mechanism for DoS.
> 
> Can either of you explain this statement a little bit more?
> 
> If an evesdropper is able to spoof an acknowledgement with a
> faulty nonce, as described in Yogesh's prior mail, it would
> seem just as capable of spoofing a RST to tear down the
> connection in one packet (not probabilistically four).
> While the nonce doesn't solve the problem of spoofing
> evesdroppers, I don't yet see how the nonce increases the
> potential for misbehavior in the network.
> 
> -neil> 
_______________________________________________
tsvwg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tsvwg