Re: syn attack and source routing

[Vadim Antonov <avg () quake net>]

Paul Vixie wrote:

> I guarantee you that if ICMP TRACEROUTE appears, at least one widely used
> router, for at least one year of its aggregate future history, will respond
> inaccurately to it.  Possibly there will even be knobs on the router to help
> network administrators configure "appropriate" responses to ICMP TRACEROUTE.

Heh.  If you want to fool somebody, you can do that with any kind of
probing technology.

The problem with inaccurate responces is usually because of badly written
specifications (when different "interpretations" are possible) or
outright bugs in software (which should be fixed).

> Vadim called "traceroute" a "UDP kludge" and so it is, but it lets me see
> what packets would do, which is a LOT more useful than seeing what a router
> wants me to see.

No, it doesn't.  How many boxes out there respond not with address of
the interface the packet come from but rather with address of any random
interface?  I've seen very weird addresses in traceroutes quite often.

And if i want you to see strange things in traceroute i can do that easily.
In fact, Andrew did that once as an April Fool joke.

> Perhaps this can be well enough specified in an I-D.  Experience says not.

Everything can be screwed up.  This is not an excuse to do nothing.

--vadim
- - - - - - - - - - - - - - - - -