Subject: [Dots] DDoS with GRE

From: Kathleen Moriarty <[email-masked]>
Date: Tue, 27 Sep 2016 09:14:50 -0400

Hi,

Is anyone familiar with the Krebs on Security DDoS:
https://noise.getoto.net/tag/gre-ddos/

Are there things we should be doing with GRE to help prevent this type of DDoS?

We are reviewing a draft on GRE-in-UDP this week, so it would be good
to know if we should be specifying more.
https://datatracker.ietf.org/doc/draft-ietf-tsvwg-gre-in-udp-encap/

Thanks!

-- 

Best regards,
Kathleen

---

From: Roland Dobbins <[email-masked]>
Date: Tue, 27 Sep 2016 20:49:43 +0700

> https://noise.getoto.net/tag/gre-ddos/

Same thing written about here, ~16-year-old technique:

<https://www.arbornetworks.com/blog/asert/rio-olympics-take-gold-540gbsec-sustained-ddos-attacks/>

> Are there things we should be doing with GRE to help prevent this type 

There's actually nothing GRE-specific about it - any IP protocol can be 
abused this way (we've seen ESP and IPv4 Protocol 0 abused the same 
way).  There's nothing needed to modify in terms of the protocol 
behavior, et. al.

Thanks much for investigating, though - it's greatly appreciated!

-----------------------------------
Roland Dobbins <[email-masked]>

---

From: Kathleen Moriarty <[email-masked]>
Date: Tue, 27 Sep 2016 09:58:54 -0400

Thanks, Roland!

On Tue, Sep 27, 2016 at 9:49 AM, Roland Dobbins <[email-masked]> wrote:
> abused this way (we've seen ESP and IPv4 Protocol 0 abused the same way).
> There's nothing needed to modify in terms of the protocol behavior, et. al.
>
> _______________________________________________
> Dots mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dots

-- 

Best regards,
Kathleen