Subject: [savi] Another possible DoS attack for FCFS

From: Dong Zhang <[email-masked]>
Date: Sun, 12 Jul 2009 12:04:54 +0800

Hi Marcelo,

The fcfs draft shows:
      "If a valid entry is found and the layer-2 information of the
      received data packet does not match the information contained in
      the existing matching entry, then the FCFS SAVI performs a
      Neighbor Unreachability Detection procedure"
Suppose that There is a binding of host A's information in savi device. An attacker
sends packets with A's IP address and its own MAC address. Therefore, each time 
the savi device receives the spoofing packets sent by the attacker, it will generate
the NUD msg to host A and A will give response as well. Thus, it forms a kind of 
amplification DoS attack. 

I read the security consideration carefully again. It indicates two kind DoS attack, 
but not includes this type above. Perhaps, I miss something.

Regards.

2009-07-12 

Dong Zhang