11–20 of 23 posts
What is a "baseline" UDP load? And why not just filter on the attacking DNS requests? At worst you'd have to spoof responses and act as a caching proxy.
Cam, why would you ban UDP when you fix source routing at layer 3 instead? The amplification attacks depend on IP transit providers routing packets from ports with a source route in that packet that arrive from an interface where they could not possibly have originated. Every router knows from static inspection of its route tables which interface a packet with the bogus packets source route would get sent to it if we…
"To prevent the spoofed reflection attacks, all network operators should implement anti-spoof address filtering [RFC2827]. This prevents the trigger of the DRDoS."
http://tools.ietf.org/html/rfc2827
"This paper discusses a simple, effective, and straightforward method for using ingress traffic filtering to prohibit DoS attacks which use forged IP addresses to be propagated from 'behind' an Internet Service Provider's (ISP) aggregation point."
Cam, why would you ban UDP when you fix source routing at layer 3 instead? The amplification attacks depend on IP transit providers routing packets from ports with a source route in that packet that arrive from an interface where they could not possibly have originated. Every router knows from static inspection of its route tables which interface a packet with the bogus packets source route would get sent to it if we…
It's considerably more complicated than that. Also, as much as we might try, BCP38 adoption is terrible.
Given the social and technical problems with BCP38 adoption I doubt we'll see source address verification in our lifetime. It's a mess. The SAVI WG at the IETF Is working on this, but it's a very tough problem.
Sounds like a violation of net neutrality. Extremely convenient excuse to throttle the new P2P protocols that are emerging and threatening to run over the top of the networks. What is a "baseline" UDP load? And why not just filter on the attacking DNS requests? At worst you'd have to spoof responses and act as a caching proxy.
Because router speed is not unlimited effectively UDP will reduce TCP's performance.
Also if UDP traffic would grow, there is the danger of congestion collapse, which means that one day the Internet would simply became so slow it would be unusable. This already happened in second half of 80s and was solved by adding congestion control and avoidance to TCP.
Why not add it to UDP? You might say. There were attempts, but are unsuccessful due to connection less nature of UDP.
This move is totally understandable and provably only thing we can effectively do today. I also don't think net neutrality can be applied here, since there is no discrimination of specific communication between two parties. All UDP traffic is limited it doesn't matter who is using it.
Many real-time applications can tolerate some packet loss, and if packets arrive out-of-order there's no benefit to re-sending them. I'm thinking of real-time games and VoIP, for example. TCP is a bad fit for these use cases. The only thing that works across nearly all routers is UDP. I'd be more interested in making UDP more secure (and learning more about best practices) than to "avoid using UDP as a transport when…
It would be much more productive to describe how UDP application protocols can be designed so that they aren't good sources of reflected DDOS.
The proposal is especially strange when you consider that almost nobody uses UDP, TCP (ok, let's be honest: HTTP) is the "default" protocol for everything. Those who do use UDP, usually have quite a good grasp of what it is and when it should be used (VoIP, video broadcasting, DNS, uTP).
Sounds like a violation of net neutrality. Extremely convenient excuse to throttle the new P2P protocols that are emerging and threatening to run over the top of the networks. What is a "baseline" UDP load? And why not just filter on the attacking DNS requests? At worst you'd have to spoof responses and act as a caching proxy.
The UDP protocol unlike TCP does not have congestion control. This means that if both protocols share the write the TCP will always back off and let UDP use as much bandwidth as it wants. Because router speed is not unlimited effectively UDP will reduce TCP's performance. Also if UDP traffic would grow, there is the danger of congestion collapse, which means that one day the Internet would simply became so slow it wo…
They made the claim in this draft that it is/was, but then failed to show or link to anything that would corroborate the claim.
At the same time, T-Mobile benefits by blocking traffic that may compete with T-Mobile's other offerings (p2p voice/video connections).