Subject: [tcpm] DoS attack from misbehaving receivers

From: Stephen Hemminger <[email-masked]>
Date: Thu, 11 Jan 2007 10:53:48 -0800

Has anyone in this group explored the problems described in:
"Misbehaving TCP Receivers Can Cause Internet-Wide Congestion Collapse"?

	http://www.cs.umd.edu/~capveg/optack/optack-ccs05.pdf
	http://www.cs.umd.edu/~capveg/
	http://www.kb.cert.org/vuls/id/102014

A possible solution (optack) is described in the paper that involves the
sender randomly skipping segments and resetting connections that
ACK data that was never sent.  But it is not clear that the impacts
of such a change have been fully investigated.

Comments?

_______________________________________________
tcpm mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tcpm

---

From: Joe Touch <[email-masked]>
Date: Thu, 11 Jan 2007 11:22:21 -0800

> of such a change have been fully investigated.

There's very little in TCP that is intended to work well with a
byzantine receiver. Except for our security protocols, very little of
the Internet deals well with them either.

Joe

-- 
----------------------------------------
Joe Touch
Sr. Network Engineer, USAF TSAT Space Segment

---

From: "Caitlin Bestler" <[email-masked]>
Date: Thu, 11 Jan 2007 12:00:59 -0800

Stephen Hemminger wrote:
> A possible solution (optack) is described in the paper that
> involves the sender randomly skipping segments and resetting
> connections that ACK data that was never sent.  But it is not
> clear that the impacts of such a change have been fully investigated.
> 
> Comments?
> 

The proposed test for a non-compliant receiver would seem to
require that the sender be non-compliant itself.

For many of the applications cited, wouldn't a more general
solution be to apply connection-specific rate limiters at
the sender (in the stack or at the application layer)?

Even if one client could truly receive at full line rate,
is is truly wise at the application layer to agree to give
all of your capacity to one client when hundreds or thousands
of clients are anticipated?