Subject: [secdir] security considerations on the TWAMP

From: Tianran Zhou <[email-masked]>
Date: Thu, 19 Dec 2019 04:14:51 +0000

Hi IPPM and SecDir,

When firstly set up the control session between the client and the server, TWAMP(RFC5357) server will listen on a specific TCP port. By default, the well-known port is 862.
However, RFC 5357 does not provide mechanism to restrict the source IP address of the request.
How do you think about the potential DDOS attack risk from the unknown IP source addresses?

Thanks,
Tianran

---

From: "MORTON, ALFRED C (AL)" <[email-masked]>
Date: Thu, 19 Dec 2019 13:38:22 +0000

Allow only known addresses, or block entire address blocks
where most attacks are coming from. Use ACLs, IPtables, firewalls,
etc.  IOW, there are plenty of mechanisms beyond TWAMP to
meet this need.

Al

From: ippm [mailto:[email-masked]] On Behalf Of Tianran Zhou
Sent: Wednesday, December 18, 2019 11:15 PM
To: [email-masked]; IETF IPPM WG <[email-masked]>
Cc: Caoli <[email-masked]>
Subject: [ippm] security considerations on the TWAMP

Hi IPPM and SecDir,

Thanks,
Tianran

---

From: Tianran Zhou <[email-masked]>
Date: Mon, 23 Dec 2019 06:12:31 +0000

Thanks Al!
Good to know your opinion on this.

Merry Christmas!
Tianran

From: MORTON, ALFRED C (AL) [mailto:[email-masked]]
Sent: Thursday, December 19, 2019 9:38 PM
To: Tianran Zhou <[email-masked]>; [email-masked]; IETF IPPM WG <[email-masked]>
Cc: Caoli <[email-masked]>
Subject: RE: security considerations on the TWAMP

Al

From: ippm [mailto:[email-masked]] On Behalf Of Tianran Zhou
Sent: Wednesday, December 18, 2019 11:15 PM
To: [email-masked]<mailto:[email-masked]>; IETF IPPM WG <[email-masked]<mailto:[email-masked]>>
Cc: Caoli <[email-masked]<mailto:[email-masked]>>
Subject: [ippm] security considerations on the TWAMP

Hi IPPM and SecDir,

Thanks,
Tianran