Subject: RE: [MMUSIC] media source ip/port in SDP

From: "Mark Watson" <[email-masked]>
Date: Wed, 12 Jun 2002 17:17:45 +0100

Does anyone think there is a security risk associated with the fact that the
source address/port of the sender is unknown to the receiver ?

I understand that there are various ways that the receiver could distinguish
RTP packets from the genuine correspondant from those of an attacker, but
even so, if the receiver is on a low-bandwidth link, these packets could
constitute a DoS attack.

A firewall could be used to control admission of packets to the
low-bandwidth link based on destination address/port (assuming the client
can open an appropriate pinhole), but you would have to wildcard the source
address. If the source address of the packets was known, the pinhole could
be made more specific, and so prevent attacks from an attacker who knew the
destination address/port.

Or can we assume that any attacker who knew the destination address/port is
probably in a position to spoof the correct source address anyway ?

As an aside, should RTCP reports be sent to the address received as source
address in incoming RTP packets, or should they be sent to the same address
as outgoing RTP packets ? If the latter (and the addresses are different),
why is the media sink device of my correspondant interested in RTCP reports
for packets generated by the media source device, which has a separate
network interface ?

Regards,

Mark Watson

> -----Original Message-----
> From: Jonathan Rosenberg [mailto:[email-masked]]
> Sent: 30 May 2002 21:18
> To: Medhavi Bhatia
> Cc: [email-masked]
> Subject: Re: [MMUSIC] media source ip/port in SDP
> 
> 
> From
> http://www.ietf.org/internet-drafts/draft-ietf-mmusic-sdp-offe
> r-answer-02.txt:
> 
> The IP address
>    and port present in the offer indicate nothing about the source IP
>    address and source port of RTP and RTCP packets that will 
> be sent by
>    the offerer.
> 
> -Jonathan R.
> 
> Medhavi Bhatia wrote:
> > 
> > Hi,
> > 
> > I remember there was a discussion some while back about 
> specifying the
> > source ip/port for the media in the SDP. Is that 
> standardized yet ? I am
> > still
> > seeing some vendors using the RFC 2327 format, and assuming that the
> > source ip or port for media will be the same as the receive 
> ip or port
> > specified in the
> > SDP.
> > Is that correct or standardized somewhere ?
> > 
> > Medhavi.
> 
> -- 
> Jonathan D. Rosenberg, Ph.D.            72 Eagle Rock Avenue
> Chief Scientist                         First Floor
> dynamicsoft                             East Hanover, NJ 07936
> [email-masked]                 FAX: (973) 952-5050
> http://www.jdrosen.net                  PH:  (973) 952-5000
> http://www.dynamicsoft.com
> 
> _______________________________________________
> mmusic mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/mmusic
>

---

From: Jonathan Rosenberg <[email-masked]>
Date: Wed, 12 Jun 2002 18:55:47 -0400

Mark Watson wrote:
> Does anyone think there is a security risk associated with the fact that
> the source address/port of the sender is unknown to the receiver ?

No. Even if its known, it can be spoofed. If you want secure RTP, I 
recommend SRTP.

> 
> I understand that there are various ways that the receiver could
> distinguish RTP packets from the genuine correspondant from those of an
> attacker, but even so, if the receiver is on a low-bandwidth link, these
> packets could constitute a DoS attack.

SRTP provides an authentication check (I believe) which allows you to 
distinguish them.

> low-bandwidth link based on destination address/port (assuming the
> client can open an appropriate pinhole), but you would have to wildcard
> the source address. If the source address of the packets was known, the
> pinhole could be made more specific, and so prevent attacks from an
> attacker who knew the destination address/port.

Well, once they find out the source (which would be just as easy as 
finding out the destination if both were in the SDP), the narrower 
pinhole doesn't help.

> 
> Or can we assume that any attacker who knew the destination address/port
> is probably in a position to spoof the correct source address anyway ?

Indeed.

> 
> As an aside, should RTCP reports be sent to the address received as
> source address in incoming RTP packets, or should they be sent to the
> same address as outgoing RTP packets ? If the latter (and the addresses
> are different),

Unless signaled explicitly with the sdp4nat extension, RTCP is sent to 
the same address as RTP, but on a port higher.

  why is the media sink device of my correspondant
> interested in RTCP reports for packets generated by the media source
> device, which has a separate network interface ?

Why would RTP and RTCP be on different network interfaces??

-Jonathan R.