Subject: [Ieprep] Revisiting IP QoS: Why do we care, what have we learned?

From: "Ayyasamy, Senthilkumar \(UMKC-Student\)" <[email-masked]>
Date: Wed, 1 Oct 2003 10:33:04 -0500

just few pointers...

In any case, the recently concluded  SIGCOMM 03 had a workshop about QoS.
http://www.acm.org/sigcomm/sigcomm2003/workshop/ripqos/ripqos-program.html

I recommend, Jon's article on predictions about QoS future .

 QoS's Downfall: At the bottom, or not at all!
 J. Crowcroft, S. Hand , R. Mortier,T. Roscoe, A. Warfield 
 ACM SIGCOMM 2003 Workshop on Revisiting IP QoS
 Karlsruhe, Germany, August 27, 2003
 http://www.intel-research.net/Publications/Berkeley/072220031010_149.pdf

the papers are available for everyone (provided as a service to all by the
members of SIGCOMM.) But, the proceedings will appear in some future CCR. 
probably, google for the paper titles or contact the authors.

>In any event, the issues with IP prioritisation on this IETF list have 
>been focused on the inter-domain context, where deployment of inter-domain
>DiffServ (or similar) mechanism creates a significant (Distributed)
>Denial of Service attack vector not present otherwise. 

Quality of Service and Denial of Service
S. Shalunov, B. Teitelbaum
ACM SIGCOMM 2003 Workshop on Revisiting IP QoS
Karlsruhe, Germany, August 27, 2003
http://people.internet2.edu/~ben/papers.html

It doesn't provide a solution. It just talks about ben/Stanislav experience 
with deploying premium service(part of QBone/I2 architecture.)

>If anyone has a technical approach that enables deployment of DiffServ 
>in an inter-domain context without creating a (D)DOS attack vector,

In any case, we need

 o proper signaling mechanism
 o demand pull from operators
 o standardization push from vendors
 o enough deployment experience (intra-domain)
 o proper Inter-domain business model.

even for *standardizing* inter-domain Differv. IMO, we have not seen
any of the above... Of course, we have RFC 2998 (Integrated Services 
Operation over Diffserv  Networks); but, it was never even deployed(?)
I don't follow NSIS. But, seems they are more interested in QoS for 
mobility etc. 

As for security breaches (DoS attacks, resource hijacking etc) regarding 
QoS, we simply don't have an answer. The process of avoiding DoS attacks 
in diffserv is not a protocol or architecture issue; it is more of 
implementation and operational issue. If we have enough diffserv 
provisioned networks across the Internet, operators will enable their 
filters accordingly. If they have proper measurement infrastructure in 
place, a tight filter( say 1:100) will help us drill down DoS attacks.

we can identify and contain DoS spread (if your clever, cut them near 
the attack source); but, can never be avoided. IP traceback, hash 
traceback, and  itrace help to identify the source. 

yes, RED-PD and pushback are router mechanisms to avoid DoS attacks. But,
many of the DoS packets are forged to look like a valid one. authentication 
mechanism (MD5 check or ipsec) are required to check for validity. In short,
we simply don't have a solution to avoid DoS attacks. 

An interesting work will be researching on identifying QoS vulnerabilities 
and drawing an attack tree for executing a DoS attack.

_______________________________________________
Ieprep mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ieprep