Subject: RE: [RPSEC] DDoS of routing ?

From: "Ayyasamy, Senthilkumar (UMKC-Student)" <[email-masked]>
Date: Thu, 13 Mar 2003 22:50:25 -0600

Iljitsch/Alex, 

> >> while a DoS attack of routing pkts by a peer can lead to RT
> >> exhaustion, is DDoS of routing pkts observed previously?
> 
> > I think attacks on port 179 of routers have been observed 
> in the wild.
> 
> This is what I have heard second hand too.

But, its not so wild like port 80 (www), 137(netbios) and 1434(sql)

Cisco routers avoids this by accepting tcp sessions from configured
peers. How does other systems avoids this port 179 attack...
particularly zebra?

port 179 attack is a way for cpu resource exhaustion. If vendors are
clever enough, heuristics can be provided at ASIC level to avoid
such attacks. 

> >> context: zinin-rtg-dos-00
> >> I guess, zinin draft talks only about DDoS of data traffic.
>
> It is all about protecting routers' control plane from user-level attacks.

Yes. I will read and sent detailed comments later.
_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

---

From: Alex Zinin <[email-masked]>
Date: Thu, 13 Mar 2003 21:43:36 -0800

Senthil,

> But, its not so wild like port 80 (www), 137(netbios) and 1434(sql)

changing the port number is not extremely hard...

> peers.

This is not a solution to the problem. An attacker can spoof the
source address easily.

>  How does other systems avoids this port 179 attack...
> particularly zebra?

Zebra works on the apps level. In zebra case the attack would
affects the code and queues below.

> clever enough, heuristics can be provided at ASIC level to avoid

I'm sure many people here would be interested to know how.

> Yes. I will read and sent detailed comments later.

Please do.

Alex