TCP RST attack (the cause of all that MD5-o-rama)

• Previous message (by thread): TCP RST attack (the cause of all that MD5-o-rama)
• Next message (by thread): TCP RST attack (the cause of all that MD5-o-rama)
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

On Tue, Apr 20, 2004 at 02:42:07PM -0700, Rodney Joffe wrote:
> 
> 
> vijay gill wrote:
> > 
> > 
> > Yes it does. About 5 mbit of md5 should peg a juniper at 100% according
> > to my friend alex.  I have not verified this in the lab.  I suggest
> > you try it out.
> > 
> > Also, this is why the GTSM (ttl hack) was written up ;)
> 
> So then you're suggesting that the GTSM is the correct work-around?
> 

No, the correct workaround is the
http://www.ietf.org/internet-drafts/draft-ietf-tcpm-tcpsecure-00.txt
draft. MD5 is also the correct workaround. However, neither of the
two protect against what is the most vulnerable thing in the internet
infrastructure today - a large amount of PPS at the _router_ (with or
without md5 or tcpsecure) will blow it out of the water. A 10mbits/s
of packets at the juniper without md5 will also destroy it.

GTSM protects against that, the fact that it also works against this
is just an unexpected side benefit.

/vijay

• Previous message (by thread): TCP RST attack (the cause of all that MD5-o-rama)
• Next message (by thread): TCP RST attack (the cause of all that MD5-o-rama)
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]