Subject: [6tisch-security] DoS

From: "Michael Behringer (mbehring)" <[email-masked]>
Date: Mon, 7 Apr 2014 15:05:23 +0000

The point I wanted to make in the call just now:

If someone malicious wants to do a DoS, he won't stick to the correct channel. It was the word "DoS" that confused me.

Listening to your arguments, I THINK the point is not about a malicious node, but about resource starvation in general. In other words, a node TRIES to do the right thing, but due to some bug, or maybe because there are too many, overloads the system.

If this is correct, I would suggest to not use the term "DoS", because that implies "malicious" (at least to me). We could use "resource starvation".

Michael

---

From: Jonathan Simon <[email-masked]>
Date: Mon, 7 Apr 2014 11:18:12 -0700

I think it’s a little more gray than that.

On the lowest level, a malicious or misconfigured device which knows nothing of the schedule (but synchronized to the network) can transmit on every slot. This looks like an in band interferer, and is almost too clumsy to call a DoS. I think resource starvation is a fine term for this.

A device that only knows the slots communicated in beacons can transmit on every possible joining slot. This has the effect of either preventing other devices from joining through the node jammed (if the validation is on L2) or blocking joining in general if the messages are validated at some central location with finite bandwidth for replies. I’d call this a DoS attack if intentional, and resource starvation if accidental, e.g. caused by a node failing to back off properly. 

-- 
Jonathan Simon, Ph. D
Director of Systems Engineering
Linear Technology, Dust Networks product group
30695 Huntwood Ave
Hayward, CA 94544-7021
(510) 400-2936
(510) 489-3799 FAX
[email-masked]

**LINEAR TECHNOLOGY CORPORATION** 
*****Internet Email Confidentiality Notice***** 
 This e-mail transmission, and any documents, files or previous e-mail messages attached to it may contain confidential information that is legally privileged. If you are not the intended recipient, or a person responsible for delivering it to the intended recipient, you are hereby notified that any disclosure, copying, distribution or use of any of the information contained in or attached to this transmission is STRICTLY PROHIBITED. If you have received this transmission in error, please immediately notify me by reply e-mail, or by telephone at (510) 400-2936, and destroy the original transmission and its attachments without reading or saving in any manner. Thank you. 

On Apr 7, 2014, at 8:05 AM, Michael Behringer (mbehring) <[email-masked]> wrote:

> If someone malicious wants to do a DoS, he won’t stick to the correct channel. It was the word “DoS” that confused me.
>  
> If this is correct, I would suggest to not use the term “DoS”, because that implies “malicious” (at least to me). We could use “resource starvation”.
>  
> Michael
>  
> _______________________________________________
> 6tisch-security mailing list
> [email-masked]
> http://cp.mcafee.com/d/avndz8Qcy0Qrhpd7bzPPab1EVdTdEK3CkPqbwVBYSyUed7aar9EVdKfffecnKr4qilH057Ox-NVsSva7X7BPp2TA4S6n-LOr3ZQnSeLsKCOYeVBdZBd4QsYJt6OaqGab7axVZicHs3jq9J4TvAm4TDNOb2pEVdTdAVPmEBC5eBYTu00U9GX33VkDa3JssDaBypuDSrzapoSVelb4OZfIT6kONsxlK5LE2FvdTw09JUQsTudCBJOsGm9BWvpKcFBziWq80WEMrjhdF_63IVmqd1WN