Subject: Re: [Ieprep] ieprep-requirements-01 - reqs 6-10 - discussion request

From: "Ayyasamy, Senthilkumar (UMKC-Student)" <[email-masked]>
Date: Mon, 4 Nov 2002 22:49:03 -0600

> > It may help if you abstract the security problem 
> > into three categories:
> >  - data security (for which object level security
> >   solutions are appropriate)
> >  - enclaving and resistance to denial of service
> >    attacks
> >  - link security issues such as traffic analysis,
> >   interceptability,jammability
> 
> It is impossible to prevent denial-of-service
> attacks.  Terribly
> sorry, but that is just the reality of the
> situation.  And it
> won't be changing soon.
  DDoS attacks are more harmful. Though, we have 
methods to prevent DoS attacks on TCP/routing 
sessions and Routing table, resistance to DDoS  
against routing and root servers infrastructure
is nil. In the wake of DDoS attacks on the root 
server last month, it is important to pay attention 
to them. 

  Compared to DDoS, flash crowd is a legitimate 
request. On days like 9/11, it is very important to 
distinguish flash crowds and DDoS traffic. 
though, it is hard to distinguish flash crowds/DDoS
traffic as both are of aggregate traffic type.

 So, the requirement doc should clearly mention 
the need for differentiating DDoS and flash crowd 
problem.

_______________________________________________
Ieprep mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ieprep

---

From: RJ Atkinson <[email-masked]>
Date: Tue, 5 Nov 2002 08:19:08 -0500

On Monday, Nov 4, 2002, at 23:49 America/Montreal, Ayyasamy, 
Senthilkumar (UMKC-Student) wrote:
>   DDoS attacks are more harmful.

Agree.

> Though, we have
> sessions and Routing table,

Please cite reference or explain.  I don't think we
can prevent all DoS attacks on TCP/routing sessions
and the routing tables.

> resistance to DDoS

Agree to both.

> traffic as both are of aggregate traffic type.

If someone has a method to distinguish an unexpected
crowd from DDOS that is proven to work, I'd be surprised
but would be happy to hear about it.

There is one misapprehension above.  Traffic graphs from
9/11/01 indicate that there was NOT a significant surge
in IP traffic.  There was a modest surge, but much less
than is regularly seen for non-calamity events (e.g.
much less than for the Mars lander).

> the need for differentiating DDoS and flash crowd

I don't want to have any requirements that can't be met
(with currently visible technology).  I think this is
just that.  If you think that it can be met, please explain how.

Thanks,

Ran
[email-masked]

---

From: Bill Woodcock <[email-masked]>
Date: Tue, 5 Nov 2002 11:03:02 -0800 (PST)

> much less than for the Mars lander).

Correct.  There was a significant increase in traffic to the CNN web site,
and a few other news sites, but it was insignificant relative to the
Internet generally.

                                -Bill