Subject: RE: [RPSEC] an anti-flooding mechanism for consideration

From: "Ayyasamy, Senthilkumar (UMKC-Student)" <[email-masked]>
Date: Thu, 3 Apr 2003 19:18:18 -0600

> At the last RPSEC meeting, a major topic of interest was how to 
> quickly determine if purported management (vs. subscriber) traffic 
> directed to a router was from an authorized source. The traffic of 
> interest includes BGP traffic sent between peers, SNMP traffic 
> between a management station and a router, etc. The goal of the 
> discussion was to find a simple mechanism that allows a router to 
> make a quick determination, probably on a line card, if a packet 
> represents legitimate management traffic, so as to be able to reject 
> bogus traffic that might overwhelm the router's management processor.
> 
> Ideally, candidate mechanisms should be resistant to 
> man-in-the-middle attacks, however there also was interest in 
> mechanisms that would not provide protection in this worst cast 
> context.
> 
> One approach to addressing this problem occurred to me after the 
> meeting. 

one more important issue seems to be verifying whether the sucessive
information comes from the same authorized source. bradner-pbk-frame
seems to propose a solution to the problem.
_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

---

From: Stephen Kent <[email-masked]>
Date: Fri, 4 Apr 2003 08:37:11 -0500

>seems to propose a solution to the problem.

The mechanism I describe has the property you note, since the hash 
chains are per source/dest pair.

Steve