On Nov 20, 2009, at 3:08 PM, Beichuan Zhang wrote: > John, > > Thanks for the comments. Xiaohu Xu also expressed similar concerns regarding > possible loops. > > The forwarding loop is only possible to level-4 aggregation and only to > prefixes that are not in the original routing table, i.e., extra routable > space. We were aware of the possibility but didn't elaborate it in the draft. > Our initial thoughts were that (1) Since it only happens to prefixes not in > the RIB, in normal operational conditions, the volume of traffic should be > negligible; (2) For an attacker to exploit this, he has to be able to direct > traffic of unreachable prefixes to a router that happens to have a loop for > that prefix. Since different routers aggregate differently, it is probably > very difficult for a remote attacker to achieve this. Likely the attack > traffic will be dropped before reaching the target router or use the wrong > target prefix.
Unless *the router* is the target - and I'd reckon that it's not actually that difficult to identify such candidate prefixes from afar.. I share John's concerns here and would like to see them addressed and/or expressly elaborated as such in the draft. -danny _______________________________________________ GROW mailing list [email protected] https://www.ietf.org/mailman/listinfo/grow
