[21439] in bugtraq
Re: Small TCP packets == very large overhead == DoS?
daemon@ATHENA.MIT.EDU (John Kristoff)
Tue Jul 10 10:51:44 2001
Message-ID: <3B4AFF8D.5D6A0A89@depaul.edu>
Date: Tue, 10 Jul 2001 08:13:49 -0500
From: John Kristoff <jtk@depaul.edu>
Reply-To: jtk@aharp.is-net.depaul.edu
MIME-Version: 1.0
To: Darren Reed <avalon@coombs.anu.edu.au>
Cc: gregory duchemin <c3rb3r@hotmail.com>, bugtraq@securityfocus.com
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Darren Reed wrote:
> Silly window sizes aren't so bad. If you have a window size of one then
> you only ever have one outstanding piece of data sent at a time. So if
> I have 16k of data, it might take 32k or more packets, but I can only send
> one packet at a time.
With a window size of 1, a misbehaving receiver might be able to
anticipate packets injected into the network by the sender. The
receiver could aggressively generate ACKs before data is actually
received (bypassing typical delayed ACK mechanisms). This may be more
of a problem for the sender if the rate of 1-byte ACKs is high. If the
connection and receiver's address could be spoofed, bursts of 1-byte
segments from the sender can be sent to an innocent victim as part of a
tinygram DoS attack.
John
