Subject: Re: [lisp] Anybody can participate in the IETF (Was: Why is IPv6 broken?)

From: [email-masked] (Noel Chiappa)
Date: Mon, 18 Jul 2011 16:36:41 -0400 (EDT)

> From: "Joel M. Halpern" <[email-masked]>

    > Fundamentally, if a subscriber DoS' himself, and denies himself
    > service, then he hurts himself. So?

The issue is that someone _outside_ can mount a DoS attack by 'bouncing'
traffic off a machine inside the site - e.g. by sending a zillion TCP SYN
requests, from random (bogus) source addresses. Jeff also raised the
possibility of a breakin inside the site (either by breaking into a
machine, or breaking into a wireless network, etc, etc.)

On another (unrelated to your question) note: I think it's worth spending a
few cycles on this to work out if the solution(s) are purely implementation
(e.g. two-stage caches, or whatever), or if there are any protocol changes
needed. If it's just the former, it can clearly be put off 'until needed'.

	Noel

---

From: "Joel M. Halpern" <[email-masked]>
Date: Mon, 18 Jul 2011 16:50:37 -0400

Okay, a reflective attack has some relevance, at least for enterprise. 
(For residential, the number of things one has to assume before this 
becomes an issue is simply too large for me to get.)

Yes, this probably does take some additional cleverness in 
implementation.  For small enterprise, I can see some ways it works. 
For large ones, we are into the problem of how to build a front-ending 
device that needs state to respond to DoS attacks, but it has to not 
fall over before the target of the DoS.

given that some large content providers are looking at this, I would be 
interested to see what paths they see as worth investigating.

Yours,
Joel

On 7/18/2011 4:36 PM, Noel Chiappa wrote:
>      >  From: "Joel M. Halpern"<[email-masked]>
>
> _______________________________________________
> lisp mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/lisp
>