Subject: RE: LLMNR Issue 39: Name conflict detection algorithm

From: "Christian Huitema" <[email-masked]>
Date: Tue, 13 May 2003 12:07:14 -0700

> > Note that, for UDP unicast responses, comparing received responses
to
> > pending queries is currently our only defence against spoofed UDP
> > unicast responses from off-link, since we no longer test TTL=255 for
> > responses.
> 
> Using multicast can help with this. If only multicast responses to
> multicast queries are accepted then cache poisoning becomes difficult.

Caching responses to someone else's queries does indeed open the gate to
cache poisoning. An attacker can first forge a query, multicast it, and
then send a forged multicast response. 

> Any attempt to poison the cache using multicast would result in the
> detection of a conflict. The host with the "real" information would
see
> the "spoofed" multicast response and likely handle it as a conflict.

In practice, that is not true. It is possible to send an IP multicast
packet to a unicast link layer address, and it is very hard for the
receiver to notice.

I would agree however that sending the replies over UDP multicast is
somewhat more secure than sending them over UDP unicast, as it is hard
to send packets to a link-scope multicast address from a remote
location.

-- Christian Huitema

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>