Re: Problems with implementation - DoS attacks possible

Mikael Olsson wrote:
> 
> 
> Backbone routers would have to track heaploads of hosts even
> during normal traffic.  Maybe they can cope with it, maybe not.
> 
> However, small edge routers would have to track heaploads of
> hosts during random source DDoS. Remember that we also send
> tracebacks to the source IPs, so these routers would suddenly have
> to remember all these fake addresses and send key disclosures to
> all of them.
> 
A backbone router at 2.8gbits/sec handles (on average) about 1.75 packets/second.
  With a probability for ITRACE emission of 1/20,000, that's 87 ITRACE packets/second.
  If the key change interval is 1 minute, and those 87 packets/second were all to
  different hosts (which they likely won't be under DDoS conditions), we have to
  remember about 5250 IP addresses, or about 160kbytes of memory for IPV6.


-- 
----------------------------------------------------------------------
Marcus Leech                             Mail:   Dept 8M70, MS 012, FITZ
Advisor                                  Phone: (ESN) 393-9145  +1 613 763 9145
Security Architecture and Planning       Fax:   (ESN) 393-9435  +1 613 763 9435
Nortel Networks                          [email protected]
-----------------Expressed opinions are my own, not my employer's------