Cam, why would you ban UDP when you fix source routing at layer 3 instead? The amplification attacks depend on IP transit providers routing packets from ports with a source route in that packet that arrive from an interface where they could not possibly have originated. Every router knows from static inspection of its route tables which interface a packet with the bogus packets source route would get sent to it if we…
that doesn't help you when the spoofed packets come in on a default route because somebody else's network is poorly configured. Nor does it help the person the spoofed attack is directed at.
Advisory Guidelines for UDP Deployment
21–23 of 23 posts
Re: Advisory Guidelines for UDP Deployment
#22Many real-time applications can tolerate some packet loss, and if packets arrive out-of-order there's no benefit to re-sending them. I'm thinking of real-time games and VoIP, for example. TCP is a bad fit for these use cases. The only thing that works across nearly all routers is UDP. I'd be more interested in making UDP more secure (and learning more about best practices) than to "avoid using UDP as a transport when…
I think they meant, avoid using over the internet.
Re: Advisory Guidelines for UDP Deployment
#23Earlier quoted context omitted.
I think they meant, avoid using over the internet.
I mean using these things over the Internet. People play games over the Internet and use VoIP over the Internet. I think these are great technologies, and I don't want to cripple them by forcing them onto TCP.