Subject: [Tsvwg] RE: Possible DoS in SCTP: How does this apply to TCP?

From: "sanjay kaniyar" <[email-masked]>
Date: Sat, 16 Feb 2002 14:35:42 -0800

Folks,

From the postings about this topic, I could gather the following about using 
IP address spoofing for DOS attack: This is not considered a major threat 
if:
(1) there is no persistent resource consumption on the victim’s machine
(2) the attacker is sacrificing (pretty much) the same amount (or order) of 
bandwidth as the victim.

Let’s consider an attacker A, victim V and a bunch of available servers on 
the internet S(i), which are available for accepting connections.

If A were to send a SYN to S(1) with source address of V, S(1) will send a 
SYN+ACK to V. Note that, S(1) will retransmit the SYN+ACK for quite a number 
of times before actually giving up (or it gets a RST from V). It may be 
possible to gag V by sending the spoofed SYN to S(1) with different source 
ports or by sending SYNs to S(2), S(3) etc. Once SYN+ACKs start getting 
queued up at the link to V, it is going to multiply rapidly because the RST 
could take longer and longer (because of duplicate SYN+ACKs). The RST 
throttling employed in some operating systems would make this worse.

Won't this constitute an attack as victim might lose 4 times the bandwidth 
(2 SYN+ACK, 2 RST) as the attacker (1 SYN)?

Thanks,
Sanjay

_________________________________________________________________
Chat with friends online, try MSN Messenger: http://messenger.msn.com

_______________________________________________
tsvwg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tsvwg

---

From: Randall Stewart <[email-masked]>
Date: Sat, 16 Feb 2002 18:00:32 -0600

Sanjay:
 
I think TCP is TCP. There is nothing that will change
any behavior you note. I will make the observation though
that in SCTP's case there is NO retransmit of SYN-ACK (i.e.
the INIT-ACK in SCTP terms). Since the sender of the INIT-ACK
retains no state and depends on the sender of the INIT's timer
to kick in and send a new INIT if the INIT-ACK is lost.

So for SCTP it is truely the same expense for V as it
is for A...

R

sanjay kaniyar wrote:
> (1) there is no persistent resource consumption on the victim?s machine
> Let?s consider an attacker A, victim V and a bunch of available servers on

-- 
Randall R. Stewart
[email-masked] 815-342-5222 (cell phone)

---

From: "Brian F. G. Bidulock" <[email-masked]>
Date: Sat, 16 Feb 2002 22:11:45 -0600

Randall,

Actually I think the SCTP situation is even better than
that.  IP spoofed INITs would be a foolish way to mount
such an attack.  S(i) will at least throttle the spoofed
INITs to some degree because it takes some time to generate
the cookie.  The attacker would be better to send its own
INIT-ACKs directly to V spoofed from S(i).  That would give
more bang for the buck in the attack.

When S(i) are made to generate a state cookie, there is a
de-amplification effect.

--brian

-- 
Brian F. G. Bidulock    ¦ The reasonable man adapts himself to the ¦
[email-masked]    ¦ world; the unreasonable one persists in  ¦
http://www.openss7.org/ ¦ trying  to adapt the  world  to himself. ¦
                        ¦ Therefore  all  progress  depends on the ¦
                        ¦ unreasonable man. -- George Bernard Shaw ¦