Subject: About SYN-flooding like attack in SCTP

From: "Lei Zhang" <[email-masked]>
Date: Mon, 28 Jul 2003 12:21:05 +0200

Hi, 

One of the famous malicious attacking in TCP is the SYN-flooding attack. However, SCTP has its own way to avoid it:

1. Only one association between endpoints
2. No resource allocated before the complete SCTP setup

My question is if the second item is necessary. Or only with the first conditon, the SYN-flooding attack might be avoided.

What I am thinking is that one association means one port to one port. Before the complete setup, eventhough any resource will be allocated, there is no case to consume up the resource of attacked host. 

looking forward to your response...

Best Regards

Lei

---

From: "Brian F. G. Bidulock" <[email-masked]>
Date: Mon, 28 Jul 2003 05:01:56 -0600

Lei,

Your error is at 1.  TCP only allows one connection between endpoints.
1. is not sufficient to avoid flooding attacks.  2. alone is sufficient
to avoid flooding attacks.

--brian

On Mon, 28 Jul 2003, Lei Zhang wrote:

> Hi, 
> 
> One of the famous malicious attacking in TCP is the SYN-flooding attack.
> However, SCTP has its own way to avoid it:
> 
> My question is if the second item is necessary. Or only with the first
> conditon, the SYN-flooding attack might be avoided.
> 
> What I am thinking is that one association means one port to one port.
> Before the complete setup, eventhough any resource will be allocated, there
> is no case to consume up the resource of attacked host. 
> 

-- 
Brian F. G. Bidulock    ¦ The reasonable man adapts himself to the ¦
[email-masked]    ¦ world; the unreasonable one persists in  ¦
http://www.openss7.org/ ¦ trying  to adapt the  world  to himself. ¦
                        ¦ Therefore  all  progress  depends on the ¦
                        ¦ unreasonable man. -- George Bernard Shaw ¦

---

From: Caitlin Bestler <[email-masked]>
Date: Mon, 28 Jul 2003 09:37:02 -0500

On Monday, July 28, 2003, at 05:21 AM, Lei Zhang wrote:

> Hi,
>
> One of the famous malicious attacking in TCP is the SYN-flooding 
> attack. However, SCTP has its own way to avoid it:
>

Actually that isn't relevant, on two points.

First, an SCTP endpoint is the Set of IP Addresses AND the SCTP port 
number.
So any two *hosts* can have a very large number of Associations between 
them.

More importantly, SYN-flood attackers do not use a real Source Address.
The entire point of SCTP cookie scheme is to defer allocation of 
resources
until the ability to round-trip with the other side has been confirmed.

An attacker who is willing to use their own source address can still 
create
a large number of associations. But you would know who they are.