Subject: Re: DDoS Work

From: "Steven M. Bellovin" <[email-masked]>
Date: Thu, 22 Mar 2001 15:08:32 -0600

In message <[email-masked]>, "Christian
 Huitema" writes:

>
>I would think that a study of mechanisms to trace the actual source of
>Internet packets would pass the charter test. After all, there have been
>several proposals to do this by letting the routers mark bits in
>packets, using a probabilistic algorithm. This seem to fall in the
>single problem / existing proposed solution / concrete deliverable
>category.

Yup.  But since I'm far from convinced of the feasibility of those 
solutions, I chose to propose ICMP Traceback as the preferred 
mechanism.  The first such scheme, by Savage et al., seems to have too 
high a computational complexity, as shown by Song and Perrig.  Song and 
Perrig have their own, much more efficient scheme, but it requires good 
knowledge of Internet topology, and I'm not convinced that that would 
be forthcoming.  All such schemes suffer from a lack of a place to do 
the marking -- using the ID field breaks fragmentation and AH, there's 
no place in the v6 header except maybe the flow label, etc.
>
>Indeed, we can also debate whether source tracing is useful...
>
Indeed.

		--Steve Bellovin, http://www.research.att.com/~smb

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: "Brian Haberman" <[email-masked]>
Date: Thu, 22 Mar 2001 17:56:59 -0500

Steve,

> no place in the v6 header except maybe the flow label, etc.

For IPv6, you could define a new extension header (hop-by-hop option).

Brian

---

From: [email-masked]
Date: Fri, 23 Mar 2001 08:04:53 +0900

#	not sure if it was okay to strip off cc: list

>For IPv6, you could define a new extension header (hop-by-hop option).

	are you suggesting to insert hop-by-hop option to packets from someone
	(will break AH and/or ESP badly), or something else?

itojun

---

From: Francis Dupont <[email-masked]>
Date: Fri, 23 Mar 2001 00:17:38 +0100

In your previous mail you wrote:

=> and the hop-by-hop option will be (slowly) processed by each router
(I don't believe this is you'd like to do)... But if we need some free
space in headers IPv6 can provide this (ie. good idea, bad keyboard :-)

Regards

[email-masked]

PS: the current discussion can give what we want. Personally I vote
for 3 (keep flow label unspecified) and to go to the bar!
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: "Brian Haberman" <[email-masked]>
Date: Fri, 23 Mar 2001 10:26:37 -0500

>         (will break AH and/or ESP badly), or something else?

I realized my mistake a few minutes after I sent the note.  This week
has been way too long!

Brian