Subject: Re: [AVTCORE] Security/Performance issue in circuit breakers

From: Harald Alvestrand <[email-masked]>
Date: Wed, 02 Apr 2014 01:41:23 +0200

I don't think I understand this problem.

But refusing to consider SDP valid that results in RTCP intervals longer
than 5 seconds sounds like a Good Thing to me.

On 03/28/2014 09:19 AM, Magnus Westerlund wrote:
> Hi,
>
> In a discussion in the RTCWEB around consent and circuit breakers I made
> a realization that there exist a significant issue in circuit breakers
> that isn't document nor dealt with.
>
> This has to do with the configuration of the RTCP bandwidth. If a
> malicious user of circuit breakers wants to make it really inefficient
> one can achieve that by configuring the RTCP bandwidth really low. So
> assuming b=RR and b=RS exists in an implementation that has circuit
> breakers. The method for making it inefficient and not affect the
> traffic pattern is to set the RTCP bandwidth really low. Using an RR=1
> bps would mean that the Td deterministic reporting interval would be ~45
> min. Thus, putting all of these limits on traffic to be no reactive
> until roughly 2-3 reporting interval, i.e. 1.5-2.25 hours have passed.
> Which is longer duration than many real-time interactive media sessions
> are to start with.
>
> I think we need to ensure that RTCP reporting is not happening less
> often than what the fixed minimal interval (5s) will mean. Thus, I see
> that including circuit breaker would require a hard requirement that one
> configure the RTCP bandwidth to allow for at least each SSRC reporting
> each 5 seconds.
>
> This also needs to go into the security consideration section to make
> clear that this is an issue.
>
> Cheers
>
> Magnus Westerlund
>
> ----------------------------------------------------------------------
> Services, Media and Network features, Ericsson Research EAB/TXM
> ----------------------------------------------------------------------
> Ericsson AB                 | Phone  +46 10 7148287
> Färögatan 6                 | Mobile +46 73 0949079
> SE-164 80 Stockholm, Sweden | mailto: [email-masked]
> ----------------------------------------------------------------------
>
> _______________________________________________
> Audio/Video Transport Core Maintenance
> [email-masked]
> https://www.ietf.org/mailman/listinfo/avt

-- 
Surveillance is pervasive. Go Dark.