Re: Stefan Savage : Hacking the TCP stack

["Frederick N. Chase" <fnc () mitre org>]

"R. DuFresne" wrote:
> Has anyone looked at the work described here:




I've made a pass through the paper by 
Savage,  Wetherall,  Karlin and  Anderson, 
which can be found at: 
http://www.cs.washington.edu/homes/savage/traceback.html.


IMHO (which is not necessarily that of my employer),
This is by far the most promising thing that's surfaced to date
for addressing distributed denial-of-service.
--It can be implemented without waiting for IPv6.
--It can be phased in in a practical way.
--It promises an effective solution to the first phase of traceback:
  finding the agent/daemon/zombies which are
  emitting the volumes of packets.

The paper appears to be quite objective as to what can be expected.

I think this should be given immediate thorough consideration
by ISPs and router vendors.

   -Fred Chase