Vulnerability Development mailing list archives

Re: "download" caps


From: pgut001 () cs auckland ac nz (Peter Gutmann)
Date: Tue, 26 Nov 2002 15:53:51 +1300 (NZDT)

J Edgar Hoover <zorch () totally righteous net> writes:

I'm wondering if you could effectively DoS a capped account for a month by
sending a lot of unrequested data.

This has happened quite a lot here, with full-rate accounts where you get
charged for traffic over a certain level, and rate-limited accounts with no
charges.  The traffic is billed based on what heads your way at the DSLAM, so
you end up being billed for syn floods, traffic aimed at whoever last had your
IP, etc etc etc.  There are no figures on this, but from anecdotal evidence a
large number of users are abandoning full-rate for rate-limited DSL which
doesn't have this problem (I switched after DSLAM records showed I'd done
130MB of traffic in two days while my external router recorded < 30MB).  It's
a pain for everyone, users go from 8MB/s to 128Kb/s, and the provider loses a 
lot of revenue when people switch to the DOS-proof non-capped (and much cheaper
because of the slow speed) accounts.  One possible solution is to run at full 
rate until you've used your monthly quota, then switch to rate-limited, but 
apparently the DSLAM technology being used makes this impossible.

Peter.


Current thread: