Re: TCP RST attack (the cause of all that MD5-o-rama)

[vijay gill <vgill () vijaygill com>]

On Tue, Apr 20, 2004 at 02:42:07PM -0700, Rodney Joffe wrote:
> vijay gill wrote:
> > Yes it does. About 5 mbit of md5 should peg a juniper at 100% according
> > to my friend alex.  I have not verified this in the lab.  I suggest
> > you try it out.
> >
> > Also, this is why the GTSM (ttl hack) was written up ;)
>
> So then you're suggesting that the GTSM is the correct work-around?

No, the correct workaround is the
http://www.ietf.org/internet-drafts/draft-ietf-tcpm-tcpsecure-00.txt
draft. MD5 is also the correct workaround. However, neither of the
two protect against what is the most vulnerable thing in the internet
infrastructure today - a large amount of PPS at the _router_ (with or
without md5 or tcpsecure) will blow it out of the water. A 10mbits/s
of packets at the juniper without md5 will also destroy it.

GTSM protects against that, the fact that it also works against this
is just an unexpected side benefit.

/vijay