-
sctp
SCTP Discussions
Text archives Help
- From: "sanjay kaniyar" <skaniyar AT hotmail.com>
- To: Michael.Tuexen AT icn.siemens.de, ajung AT exp-math.uni-essen.de, randall AT stewart.chicago.il.us
- Cc: john.loughney AT nokia.com, discussion AT sctp.de, thomas.hollaus AT siemens.at, tsvwg AT ietf.org
- Subject: [SCTP-Discussion] RE: Possible DoS in SCTP: How does this apply to TCP?
- Date: Sat Feb 16 23:47:00 2002
- List-id: SCTP Discussions <discussion.sctp.de>
Folks,
From the postings about this topic, I could gather the following about using IP address spoofing for DOS attack: This is not considered a major threat if:
(1) there is no persistent resource consumption on the victims machine
(2) the attacker is sacrificing (pretty much) the same amount (or order) of bandwidth as the victim.
Lets consider an attacker A, victim V and a bunch of available servers on the internet S(i), which are available for accepting connections.
If A were to send a SYN to S(1) with source address of V, S(1) will send a SYN+ACK to V. Note that, S(1) will retransmit the SYN+ACK for quite a number of times before actually giving up (or it gets a RST from V). It may be possible to gag V by sending the spoofed SYN to S(1) with different source ports or by sending SYNs to S(2), S(3) etc. Once SYN+ACKs start getting queued up at the link to V, it is going to multiply rapidly because the RST could take longer and longer (because of duplicate SYN+ACKs). The RST throttling employed in some operating systems would make this worse.
Won't this constitute an attack as victim might lose 4 times the bandwidth (2 SYN+ACK, 2 RST) as the attacker (1 SYN)?
Thanks,
Sanjay
_________________________________________________________________
Chat with friends online, try MSN Messenger: http://messenger.msn.com
- [SCTP-Discussion] RE: Possible DoS in SCTP: How does this apply to TCP?, sanjay kaniyar, 02/16/2002
Archive powered by MHonArc 2.6.19+.
