Subject: [midcom] Acceptable Security Solutions

From: Mark Taylor <[email-masked]>
Date: Thu, 16 May 2002 04:57:50 -0700 (PDT)

The actions of STUN attackers that have been
considered in the last few weeks bear a resemblance to
the activities of packet sniffers. Packet sniffers are
dealt with not in the protocols themselves but by the
detection of their specific behaviors as they attempt
to accomplish their goals. So, for example, packet
sniffers can be detected by identifying who is
performing reverse ARPs. 

Hypothetically the same sort of thing could be done
for STUN attackers by, for example, detecting multiple
replies, DOS attacks on servers etc. Individual
transactions would not be protected but again
hypothetically the attacker identity or location in
respect to paths to specific STUN servers could be
determined and dealt with on ongoing basis.

My question is whether this sort of protocol-external
security procedure, akin to that done for the similar
packet sniffing attackers, would be considered to be a
satisfactory solution to the issue of STUN security.

__________________________________________________
Do You Yahoo!?
LAUNCH - Your Yahoo! Music Experience
http://launch.yahoo.com

_______________________________________________
midcom mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/midcom