Subject: [mobile-ip] Error DOS Attack?

From: "James Kempf" <[email-masked]>
Date: Wed, 8 May 2002 15:33:33 -0700

Section 6.1.1 of draft 17 specifies that an error is sent to the source
if the MH type is not recognized (pg. 32).

An attacker could pump packets at the CN or MN with erroneous MH type
values, and the attacked node would have to continue replying, thus
tying it up. None of the rest of the RR protocol seems to have any error
returns, so this would be the only place that it could occur.

Is this worth worrying about?

            jak

---

From: Jari Arkko <[email-masked]>
Date: Thu, 09 May 2002 08:55:08 +0300

> Is this worth worrying about?

In a way this seems similar for any IP protocol, i.e. there aren't any
new reflection-to-third-party or amplification concerns. For instance,
even if the protocol didn't have MH type error return, you could
send UDP with dst port = random, and an ICMP would be returned...
one difference however appears that ICMPs are typically rate-limited.
We should propably do the same for MH Type errors... checking... no
we don't do this yet. Should add this to the document.

Jari

---

From: Erik Nordmark <[email-masked]>
Date: Tue, 14 May 2002 14:20:54 +0200 (CEST)

> Is this worth worrying about?

It might make sense to copy the ICMP error generation behavior
from the ICMPv6 specification which is basically to rate limit
errors.

  Erik