3 ms·
> Routers will accept a "shut up" request This shifts the DoS threat from servers to clients. How does the router know that the request from A to block B is le
by solatic 5y ago
> Routers will accept a "shut up" request
This shifts the DoS threat from servers to clients. How does the router know that the request from A to block B is legit? Just because the router can ping A? Behold, a system where you can shut down your enemies for good by paying botnets to send requests to block B.
- mjevans 5y agoIt's implied that the block is ONLY for traffic TO A FROM B; via R (router) (with R having the chance to aggregate? Maybe based on owning delivery paths that are valid?). Full quote: "- Routers will accept a "shut up" request. If A wants to block B, it sends to a router on the path, the router pings A to validate the source, and then blocks traffic from B to A for a few minutes. This also contains DDOS attacks. Routers can forward "shut up" requests to the next router in the path, for further containment."
- solatic 5y agoThis is slightly disingenuous. If I'm a router manufacturer, and there's a protocol that will tell me "peers such-and-such are troublemakers", and I get twenty such notifications from downstream that peer Foo is being a troublemaker, then I can automatically block all traffic from peer Foo (forget about what the protocol actually intended) and actually sell that as a security feature.
- soneil 5y agoSo many conversations like this wouldn't have existed if the internet had been designed for zero-trust from day one. Imagine if all icmp / igmp had the possibility to sign requests.