Subject: RE: Next question...

From: "Tony Li" <[email-masked]>
Date: Mon, 9 Dec 2002 11:06:27 -0800

|   Tony Li wrote:
|   > |   I would still like some hint from the host to the border 
|   > |   router that the
|   > |   current connection isn't working.
|   > 
|   > 
|   > Not an unreasonable request.
|   
|   At first blush this may seem like a reasonable request, but 
|   there are so 
|   many reasons why a remote host would not respond that it would be 
|   impossible for the routing system to trust the local host with such 
|   requests.  For instance, perhaps the reason the remote host isn't 
|   responding is because the remote application has not properly 
|   authenticated the local user.  Another reason is that the 
|   remote host is 
|   down or misconfigured.

Assuming that the request is authenticated, what's the real issue?  
Yes, the host cannot know that it is impossible to satisfy the 
request, but all this is is a hint to try another alternative.

Tony

---

From: Eliot Lear <[email-masked]>
Date: Mon, 09 Dec 2002 11:21:05 -0800

> request, but all this is is a hint to try another alternative.

I DDOS attack the far end.  The local end then sends an authenticated 
hint to the routing system.  In fact, if I DDOS a popular host, I can 
get a lot of local ends to provide "hints" and thus indirectly DDOS the 
routing system.  And then suppose the routing system believes the hint. 
  Now I can stop my DDOS on the host and go hide.

OTOH, if a host wants to provide either quality or reachability 
information about itself, I'm okay with that so long as it's 
authenticated and we can find a way to sanely aggregate the information.

Eliot