Subject: RE: LLMNR and Rendezvous TTL disagreement, a modest proposal

From: "Christian Huitema" <[email-masked]>
Date: Tue, 24 Feb 2004 10:38:29 -0800

> The TTL=1 argument provides nothing at all that helps avoid DoS
> attacks - what the specification says should be done is irrelevant
> to an attacker, if they want to bombard you, and they're 10 hops
> away, they'll set the TTL to 11 (or more) regardless of what the
> spec says it should be set to.

The difference is with reflection attacks. A worm sends an LLMNR request
to the local network, spoofing the source address of a target. With
TTL=255, the response to the request can bomb any site on the Internet;
with TTL=1, the response will only travel one hop.

-- Christian Huitema 

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Paul Vixie <[email-masked]>
Date: Tue, 24 Feb 2004 18:50:20 +0000

> with TTL=1, the response will only travel one hop.

once again we see that there are cogent arguments to be made for both
ttl settings, but that consensus proves elusive.  we can flipflop on
this for many years to come, or we can find a compromise (which means
"a solution which displeases everyone equally".)

---

From: Ted Lemon <[email-masked]>
Date: Tue, 24 Feb 2004 15:27:12 -0500

> "a solution which displeases everyone equally".)

I beg to differ.   This is not a cogent argument, because the bombing 
scenario can't happen unless all the routers on the internet are very 
carefully broken.   Furthermore, it's an irrelevant argument, because 
we've (at least, some of us have) agreed that we don't need the TTL=255 
check for multicast anyway, and it's sufficient to have it just for 
unicast.

I think we're very close to a compromise here, if the authors are 
willing to consider the proposed changes.   I don't understand why 
Christian brought up the bomb argument again, or what it has to do with 
the ongoing discussion.

---

From: Robert Elz <[email-masked]>
Date: Wed, 25 Feb 2004 04:07:26 +0700

Date:        Tue, 24 Feb 2004 10:38:29 -0800
    From:        "Christian Huitema" <[email-masked]>
    Message-ID:  <[email-masked]>

  | The difference is with reflection attacks. A worm sends an LLMNR request
  | to the local network, spoofing the source address of a target. With
  | TTL=255, the response to the request can bomb any site on the Internet;
  | with TTL=1, the response will only travel one hop.

This works only if the request is one that many nodes on the local link
will answer.  If only one (or a small number) reply, then the bomb is
just 2 or 3 packets, which isn't much to be concerned about.

If there is some request that lots of nodes will answer, which would make
that an affective attack, then really what ought to be done is to fix things
so that there aren't lots of answers - that's useful just for local genuine
queries, which don't want a hundred answers either.   Even with TTL=1,
if there was an avenue for attack here, it would be a good way to neutralise
a system on a link - just get everyone else on the link to bomb it.   That
we don't want - so preventing the mass replies is the better solution.

kre

ps: Ted, Christian's scenario here involves unicast replies aimed at a victim,
this one isn't multicast.

---

From: Mika Liljeberg <[email-masked]>
Date: Tue, 24 Feb 2004 23:35:33 +0200

> check for multicast anyway, and it's sufficient to have it just for 

Reflection attack is a possibility if the attacker sends a spoofed query
to a multicast group of higher than link-local scope or to a broadcast
address.

	MikaL