Re: SIP amplification vulnerability -01 (draft-zourzouvillys-sip-via-cookie-01)

On Mon, Mar 2, 2009 at 3:22 AM, Hadriel Kaplan <[email protected]> wrote:

Hi Hadriel,

> So if the protection mechanism involved requires a change on the proxy and a change on the UA's, to do the via-cookie mechanism, then why do the change so high in the SIP stack?

only for adoption reasons:

First, It seemed to big a change to push and in reality get adopted in
the "short" term by people as any other lower change requires more
than just a few lines of code for people that want to implement it
without caring about performance (for example, a SIP phone or
something else that is not worried about high performance).  DCCP
offers the same features at a level already implemented by most major
operating systems, as does DTLS - so we could use either of those and
the problem goes away, too with potentially less complexity for
implementers (at least in the DCCP case).

Second, there are already a scary number of ALGs on DSL/cable routers
and deployed out there - any non 3261 compliant method would likely
require many of those be updated as well, although with all the SIP
diagnostic tools like ethereal/wireshark and monitoring etc.

 ~ Theo
_______________________________________________
Sip mailing list  https://www.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email protected] for questions on current sip
Use [email protected] for new developments on the application of sip