Re: Time-To-Live?

At 09:56 AM 7/2/99, Chris Davenport wrote:
>I'm not clear on why Time-To-Live (TTL) is needed.  It strikes me
>that this adds complexity to the server software while adding nothing
>to the reliability or resilience of the protocol.  Why not simply
>have the client time-out and retransmit and the server silently ignore
>duplicates?

If the server cannot complete the work in the given "time-to-live" then we
want the server to notify the client of this BEFORE it processes the message.

I agree this is hard to impliment as the server needs to estimate how much
time a message may take to process. 

>
>It worries me that an overloaded server could cause a huge number of
>error messages and retransmissions to flood the network.  Consider
>a high-volume SCMP server which becomes so oversubscribed that many
>inbound messages are exceeding their TTL.  This causes a flow of error
>messages to emanate from the server back to the various clients.  At
>the same time the clients may also be sending retransmissions because
>they've timed out too.  This might exacerbate the problem by increasing
>the load on the server still more and resulting in even more error
>messages.

This is an issue. However there are other ways for denial of service attacks
to occur without using the "time-to-live" method. For exampe a client that
formats
the message badly will result in a decryption error message which could also
be exercised for a DOS attack.

Anybody have any thoughts as how to aviod DOS attacks in these type of
protocols?

>
>Just a thought.
>
>Chris.
>
>-- 
>Chris Davenport
>[email protected]


Jason Eaton			CyberSource Corporation
Phone 408.260.6044		Security Engineering Manager
[email protected]	http://www.cybersource.com