Subject: RE: [MMUSIC] RTSP connections question.

From: "Thomas Zeng" <[email-masked]>
Date: Wed, 16 Feb 2005 15:28:35 -0800

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]On Behalf
Of Aravind Narasimhan
Sent: Wednesday, February 16, 2005 2:35 PM
To: [email-masked]
Subject: [MMUSIC] RTSP connections question.

Section 9.3 of rtsp-bis08 indicates the following:

> A server SHOULD NOT initiate a close of a connection directly after 
> responding to a TEARDOWN request for the whole session. A server 
> SHOULD NOT close the connection as a result of responding to a request 
> with an error code. Doing this would prevent or result in extra 
> overhead for the client when testing advanced or special types of 
> requests.

But this seems like a DoS security risk.  If a malicious user decided to 
send gibberish request or request that are almost correct and but not 
quite, the server may respond with an error code because it can't parse 
the request.  But if it cannot close its connection to the client, then 
the client may overload the server with many gibberish requests and 
eventually cause the server to not accept valid connections. 

[tz] My understanding is that the server has the freedom to include the "Connection: close" header if it suspects that the client is launching a DoS attack and wants to close the connection after the current request/response is complete. See Section 12.10 of RFC2326.

What is the purpose of saying that the server SHOULD NOT close the 
connection as a result of responding to a request with an error code?  
It seems like it would be the right thing to do, no?

Aravind

_______________________________________________
mmusic mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mmusic

_______________________________________________
mmusic mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mmusic