14 ms·
QUIC actually requires that request packets must be larger than the responses, until a handshake has been performed, in order to prevent reflection attacks.
by lclarkmichalek 8y ago
QUIC actually requires that request packets must be larger than the responses, until a handshake has been performed, in order to prevent reflection attacks.
- skybrian 8y agoDo you mean larger or smaller? I thought the problem was amplification.
- lclarkmichalek 8y agoWoops, fixed, thanks :)
- scurvy 8y agoDoes QUIC allow for UDP fragments? If so, we're screwed since most traffic is still IPv4.
- mcpherrinm 8y agoThe previous post's point is not that QUIC can be used for reflection attacks. It is that it uses UDP, which means UDP cannot be blocked by simple ACLs. Blocking all UDP is a simple technique for avoiding other protocols that allow for reflection DDoS attacks. I haven't got experience with how effective blocking UDP is as a mechanism for avoiding DDoS, but it does sound pretty simple and easy to deploy.