Subject: Re: LLMNR and Rendezvous TTL disagreement, a modest proposal

From: Derek Atkins <[email-masked]>
Date: Tue, 02 Mar 2004 00:24:45 -0500

Andras Salamon <[email-masked]> writes:

> On Thu, Feb 26, 2004 at 12:56:46AM -0800, Bernard Aboba wrote:
>> If there is to be a "compromise" I believe that it should be
>> to set TTL=255 on responses and (optionally) check on the sender, while
>> *always* setting TTL=1 on queries.
>
> Sounds reasonable to me.

But now you're open to smurf attacks, where I send a LLMNR request to
a responder, setting YOUR ip address as the source, and setting the
TTL to make sure the packet arrives "properly".  Or do we just not
care about this?

I can make sure you send the packet, and with TTL=255 the response
will always make it back to the "sender" (which is YOUR ip address in
this case).

So, what is the threat(s) we're trying to solve?  In particular, what
threat does TTL=255 on responses actually solve?

-derek

-- 
       Derek Atkins                 617-623-3745
       [email-masked]             www.ihtfp.com
       Computer and Internet Security Consultant

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Derek Atkins <[email-masked]>
Date: Tue, 02 Mar 2004 00:24:45 -0500

-derek