[4587] in North American Network Operators' Group

home help back first fref pref prev next nref lref last post

Re: syn attack and source routing

daemon@ATHENA.MIT.EDU (Vadim Antonov)
Wed Sep 18 18:41:51 1996

Date: Wed, 18 Sep 1996 15:34:09 -0700
From: Vadim Antonov <avg@quake.net>
To: nanog@merit.edu, paul@vix.com

Paul Vixie wrote:

>I guarantee you that if ICMP TRACEROUTE appears, at least one widely used
>router, for at least one year of its aggregate future history, will respond
>inaccurately to it.  Possibly there will even be knobs on the router to help
>network administrators configure "appropriate" responses to ICMP TRACEROUTE.

Heh.  If you want to fool somebody, you can do that with any kind of
probing technology.

The problem with inaccurate responces is usually because of badly written
specifications (when different "interpretations" are possible) or
outright bugs in software (which should be fixed).

>Vadim called "traceroute" a "UDP kludge" and so it is, but it lets me see
>what packets would do, which is a LOT more useful than seeing what a router
>wants me to see.

No, it doesn't.  How many boxes out there respond not with address of
the interface the packet come from but rather with address of any random
interface?  I've seen very weird addresses in traceroutes quite often.

And if i want you to see strange things in traceroute i can do that easily.
In fact, Andrew did that once as an April Fool joke.

>Perhaps this can be well enough specified in an I-D.  Experience says not.

Everything can be screwed up.  This is not an excuse to do nothing.

--vadim

home help back first fref pref prev next nref lref last post