Subject: iSCSI: ping data size

From: Eddy Quicksall <[email-masked]>
Date: Fri, 16 Aug 2002 08:00:11 -0400

Is there a good reason why the originator would need ALL of the ping data
back?
 
If not, can we allow the size of ping response data to be at the responders
discretion?
 
Eddy
mailto:[email-masked]

---

From: "Julian Satran" <[email-masked]>
Date: Fri, 16 Aug 2002 15:26:54 +0300

The originator may be trying to measure something. Allowing the responder 
to twart the answer would be counterproductive.

Julo

Eddy Quicksall <[email-masked]>
Sent by: [email-masked]
08/16/2002 03:00 PM

        To:     "ips@ece. cmu. edu (E-mail)" <[email-masked]>
        cc: 
        Subject:        iSCSI: ping data size

If not, can we allow the size of ping response data to be at the 
responders discretion?
 
Eddy

---

From: "Julian Satran" <[email-masked]>
Date: Mon, 19 Aug 2002 13:41:42 +0300

Glen,

A DoS attack can use several other mechanisms too (not only NOPs). And it 
can be avoided by just
having the target of the attack dropping the connection with an initiator 
that issues excessive amount of NOPs with data and limiting the allowed 
ping size.

Julo

Glen Turner <[email-masked]>
08/19/2002 09:19 AM

        To:     Julian Satran/Haifa/IBM@IBMIL
        cc:     Eddy Quicksall <[email-masked]>, "ips@ece. cmu. edu (E-mail)" 
<[email-masked]>
        Subject:        Re: iSCSI: ping data size

Julian Satran wrote:
> 
> The originator may be trying to measure something. Allowing the 
> responder to twart the answer would be counterproductive.

As pointed out before, this allows a denial of service attack on
public iSCSI servers (such as CD-ROM stackers in libraries)

-- 
  Glen Turner                                 Network Engineer
  (08) 8303 3936      Australian Academic and Research Network
  [email-masked]          http://www.aarnet.edu.au/
--
  The revolution will not be televised, it will be digitised