Subject: RE: [Ieprep] DDOS prevention

From: "Ayyasamy, Senthilkumar (UMKC-Student)" <[email-masked]>
Date: Tue, 5 Nov 2002 17:04:47 -0600

> >  One can trace the source of the DDoS attack by means
> > of many identification methods like ...
> 
> Unfortunately, a good DDOS attack packet looks identical to
> legitimate traffic.  We've seen that sort of DDOS attack within
> the past fortnight.  So I don't think we can *prevent*
> DDOS attacks.  You did describe a number of ways to track
> down DDOS attackers that aren't clever -- and those methods
> are useful.  They just aren't totally effective at preventing
> DDOS.

 Yes. First of all, we are lacking in proper deployable methods
for identifying and characterizing DDoS attacks. Some DDoS attacks 
are really surprising and it is really hard to get the 
fingerprint/signature of the DDoS traffic trace. In some cases, it 
is very difficult to distinguish DDoS pkts from normal aggregate 
traffic. It needs some kind of backscatter analysis (caida's work)
to indentify them.
 Although, this might sound philosophical but only way to avoid 
this problem is to have a "epidemic center" which maintains 
various signatures of DoS traces/ patterns of worms like Code RED
etc/ and other things. If anyone has any views on this point, I am 
not responsible as its the idea of vern paxson 
( look for his work on "How to 0wn the Internet in Your Spare Time" 
presented at recent USENIX/Nanog sessions)

> A point Mike O'Dell mentioned earlier today is that deployment
> of DiffServ actually *creates* a new potential DDOS vulnerability
> for the ISP that deploys DiffServ.  He's right about that, too.

 I would be interested in knowing about the vulnerability.
Any pointers/details? 

_______________________________________________
Ieprep mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ieprep