Subject: Re: ECN and ISOC... tcptraceroutes needed

From: Franck Martin <[email-masked]>
Date: 03 Aug 2002 12:35:29 +1200

Sally

Would you be kind enough to contact minerva ([email-masked]) and
ISOC Anne Shroeder ([email-masked]) with this information and may be
provide them with some help.

As you are one of the authors of ECN, I think your help would be more
than appreciated and would give a case study on how to fix this...

Thanks in advance
[email-masked]

On Sat, 2002-08-03 at 11:25, Sally Floyd wrote:

    >Minerva, the ISP of ISOC has been alerted and are working on the problem
    >but cannot locate exactly where is the problem, if you have any
    >information on where ECN packets are discarded please provide this
    >information to [email-masked] add [HelpDeskTicket=12181] at the end
    >of the subject.
    >
    >I think you may have more tools htan me to locate the faulty
    >router/firewall/host?
    >
    >Thanks for helping locate the problem.
    
    The "ECN-under-Linux Unofficial Vendor Support Page" web page 
    at "http://gtf.org/garzik/ecn/"  lists the known vendor equipment
    that has problems, with pointers to the bug-fixes provided by those
    vendors.
    
    There is also an internet-draft about this problem,
    "Inappropriate TCP Resets Considered Harmful", at
    "http://www.ietf.org/internet-drafts/draft-floyd-tcp-reset-04.txt".
    This was approved to become a BCP on June 11.
    
    - Sally
    http://www.icir.org/floyd/
    
    From draft-floyd-tcp-reset-04.txt, for background history:
    
       Unfortunately, misconceived security concerns are one of the reasons
       for the problems described in this document in the first place.  An
       August, 2000, article on "Intrusion Detection Level Analysis of Nmap
       and Queso" described the port-scanning tool Queso as sending SYN
       packets with the last two Reserved bits in the TCP header set, and
       said the following:  "[QUESO] is easy to identify, if you see [these
       two Reserved bits and the SYN bit] set in the 13th byte of the TCP
       header, you know that someone has malicious intentions for your
       network."  As is documented on the TBIT Web Page, the middleboxes
       that block SYNs using the two ECN-related Reserved flags in the TCP
       header do not block SYNs using other Reserved flags in the TCP
       header.
    
       One lesson appears to be that anyone can effectively ``attack'' a new
       TCP function simply by using that function in their publicly-
       available port-scanning tool, thus causing middleboxes of all kinds
       to block the use of that function.

---

From: Franck Martin <[email-masked]>
Date: 03 Aug 2002 12:35:29 +1200

Sally

Thanks in advance
[email-masked]

    

    - Sally

---

From: Franck Martin <[email-masked]>
Date: 03 Aug 2002 12:35:29 +1200

Sally

Thanks in advance
[email-masked]

    

    - Sally

---

From: Franck Martin <[email-masked]>
Date: 03 Aug 2002 12:35:29 +1200

Sally

Thanks in advance
[email-masked]

    

    - Sally

---

From: Sally Floyd <[email-masked]>
Date: Fri, 02 Aug 2002 16:25:58 -0700

- Sally