|
North American Network Operators Group Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical Re: New Internet-draft on DDOS defense...
> > > > >Another point that hasn't been mentioned in this thread is that this type > >of attack is very easy to track down, since all the echo-reply packets > >will have addresses in the same subnet. A good portion of the problem > >with smurf attacks is not so much the attack itself as the painful process > >of tracking it to it's source. > > > > By the time you trace the packets, identify the subnet, and convince the > Network Administrator to detach the compromized system from the network, > the victim's router might have crashed. Especially, when there are more > than one DDoS agents are compromized over different networks, the > victim site may loose several hours of business! Having been there, your solution mode is all wrong. What would happen in a case like this where a DOS attack has a localized source is that you would get the upstreams to filter them out. May take a few minutes, but given the ease of tracing it should be quick (once you get the right ISP team working on it.) Not too many people have more than a DS3 or two serving a subnet, and in today's world the backbone can handle that much smurf even if the egress hose can't. Also the pain point of the solution will cure the DOS source. The ISP serving the source first disconnects the circuit completely, then contacts the network administrator and asks him/her to cease and decist. No fix, no Internet! I am willing to bet that being a localized source of a DOS attack does not fall within ISP AUPs. Besides the idea that the cure is way to much for the problem, there is the deployment issue. It usually takes 5-10 years (or more) for a solution like this to saturate the installed base. Our problems wil be much different then. The work in DOS needs to be much more focused on the hard problems of tracking distributed spoofed attacks and automatic attack characterization, not wasting time on this kind of stuff. I think that other than you defending this, there has been no support. Please take it as hint. jerry > > Vipul > > >Brandon Ross 404-522-5400 > >VP Engineering, NetRail http://www.netrail.net > >AIM: BrandonNR ICQ: 2269442 > >Read RFC 2644! > >Stop Smurf attacks! Configure your router interfaces to block directed > >broadcasts. See http://www.quadrunner.com/~chuegen/smurf.cgi for details. > > > > > > > > >
|