Subject: Re: [Dots] [tsvwg] Best transport selection during an attack?

From: <[email-masked]>
Date: Wed, 04 Nov 2015 09:26:02 -0700

Sending an "emergency" notification that you are under a DOS attack via
TCP 
is stupidity worthy of victims in a horror movie.

If you are under a DOS attack your ability to confirm a TCP connection
(or
SCTP association) is also under attack. Your ability to send the SOS
cannot
be dependent on you receiving any packets.

If there is an issue of not having a UDP path to the target then you
need to
provision a proxy that is UDP reachable. OF course that only works until
the
attackers figure out to attack the proxy as well.

There is not much an attacker can do to prevent your sending UDP
datagrams,
however, other than flooding every possible recipient. That raises the
cost
of a DOS attack from attacking one server to attacking entire networks,
making
any such attack far less feasible.

---

From: "Roland Dobbins" <[email-masked]>
Date: Thu, 05 Nov 2015 01:48:22 +0900

On 5 Nov 2015, at 1:26, [email-masked] wrote:

> need to provision a proxy that is UDP reachable

This has already been discussed extensively and is addressed in the 
requirements draft and the use-cases draft, FYI.

> OF course that only works until the attackers figure out to attack the 
> proxy as well.

If attackers can arbitrarily send packets to the DOTS client, DOTS 
relay, and/or DOTS server, then implementation BCPs aren't being 
followed.

-----------------------------------
Roland Dobbins <[email-masked]>