Internet Denial-of-Service Considerations

Metadata

Publisher: IETF
Doc Type: Informational
Pages: 38
Abstract: This document provides an overview of possible avenues for denial-of-service (DoS) attack on Internet systems. The aim is to encourage protocol designers and network engineers towards designs that are more robust. We discuss partial solutions that reduce the effectiveness of attacks, and how some solutions might inadvertently open up alternative vulnerabilities. This memo provides information for the Internet community.
Publication Date: 2006-12-01
Status Note: Informational
DOI: 10.17487/RFC4732
Link: https://doi.org/10.17487/RFC4732
Author(s): Mark J. Handley
Eric Rescorla
IAB
Keyword(s): DoS

Latest version of IETF RFC 4732

Document Versions — IETF RFC 4732

▶ IETF RFC 4732 (2006-12-01)

THIS DOC [ACTIVE] [LATEST VERSION]

Amended by:

IETF RFC 8996 [Active*]

Normative Reference(s)

L. von Ahn, M. Blum, N. Hopper, and J. Langford. CAPTCHA: Using hard AI problems for security. In Proceedings of Eurocrypt, 2003. EXTERNAL
D.J. Bernstein, "SYN Cookies", http://cr.yp.to/syncookies.html . EXTERNAL
J. Abley, "Hierarchical Anycast for Global Service Distribution", http://www.isc.org/index.pl?/pubs/tn/ index.pl?tn=isc-tn-2003-1.txt . EXTERNAL
IETF RFC 1075 [Active*]
IETF RFC 1112 [Active*]
IETF RFC 2385 [Superseded*]
IETF RFC 2439 [Active*]
IETF RFC 2827 [Active*]
IETF RFC 2918 [Active*]
IETF RFC 3682 [Superseded*]
IETF RFC 4271 [Active*]
IETF RFC 4346 [Superseded*]
IETF RFC 4601 [Superseded*]

Bibliographic Reference(s)

D.F. Chang, R. Govindan, J. Heidemann, "An Empirical Study of Router Response to Large Routing Table Load", Proceedings of the 2nd Internet Measurement Workshop (IMW 2002), 2002. EXTERNAL
Stewart, R., Ed., and M. Dalal, Ed., "Improving TCP's Robustness to Blind In-Window Attacks", Work in Progress, June 2006. EXTERNAL
Scott A Crosby and Dan S Wallach, "Denial of Service via Algorithmic Complexity Attacks", Proceedings of the USENIX Security Symposium, Washington D.C., August 2003. EXTERNAL
D. Pei, X. Zhao, L. Wang, D. Massey, A. Mankin, F. S. Wu, and L. Zhang. Improving BGP Conver-gence Through Assertions Approach. In Proc. of IEEE INFOCOM, June 2002. EXTERNAL
V. Paxson, "An Analysis of Using Reflectors for Distributed Denial-of-Service Attacks", Computer Communication Review 31(3), July 2001. EXTERNAL
P. Vixie, "Securing the Edge", http://www.icann.org/committees/security/sac004.txt . EXTERNAL
X. Zhao, D. Massey, A. Mankin, S.F. Wu, D. Pei, L. Wang, L. Zhang, "BGP Multiple Origin AS (MOAS) Conflicts", http://nanog.org/mtg-0110/lixia.html , 2001. EXTERNAL
J. Mogul, KK. Ramakrishnan, "Eliminating Receive Livelock in an Interrupt-driven Kernel", ACM Transactions on Computer Systems, Vol 15, Number 3, pp. 217-252, 1997. EXTERNAL
M. Lough, "A Taxonomy of Computer Attacks with Applications to Wireless", PhD thesis, Virginia Polytechnic Institute, April 2001. EXTERNAL
Cisco Systems, "Building Security Into the Hardware", ftp://ftp-eng.cisco.com/cons/isp/security/CPN-Summit-2004/ Paris-Sept-04/SE14-BUILDING-SECURITY-INTO-THE-HARDWARE- c1_8_30_04.pdf, 2004. EXTERNAL
P. Vixie, G. Sneeringer, M. Schleifer, "Events of 21-Oct-2002", http://f.root-servers.org/october21.txt . EXTERNAL
J. Bellardo, S. Savage, "802.11 Denial-of-Service Attacks: Real Vulnerabilities and Practical Solutions", Proceedings of the USENIX Security Symposium, Washington D.C., August 2003. EXTERNAL
Chavali, S., Radoaca, V., Miri, M., Fang, L., and S. Hares, "Peer Prefix Limits Exchange in BGP", Work in Progress, April 2004. EXTERNAL
Z. Mao, R. Govindan, G. Varghese, R. Katz, "Route Flap Dampening Exacerbates Internet Routing Convergence", Proceedings of ACM SIGCOMM, 2002. EXTERNAL
M. Zalewski, "Strange Attractors and TCP/IP Sequence Number Analysis", http://www.bindview.com/Services/Razor/Papers/2001/tcpseq.cfm . EXTERNAL
CERT Advisory CA-1998-01, "Smurf IP Denial-of-Service Attacks", http://www.cert.org/advisories/CA-1998-01.html , Jan 1998. EXTERNAL
Cisco Systems, "Configuring the BGP Maximum-Prefix Feature", Cisco Document ID: 25160, http://www.cisco.com/warp/public/459/bgp-maximum-prefix.html . EXTERNAL
CERT/CC - "Managing the Threat of Denial of Service Attacks", http://www.cert.org/archive/pdf/Managing_DoS.pdf . EXTERNAL
CERT Incident Note IN-2000-05, "'mstream' Distributed Denial of Service Tool", May 2000. EXTERNAL
S.M. Bellovin, "Security Problems in the TCP/IP Protocol Suite", Computer Communication Review, Vol. 19, No. 2, pp. 32-48, April 1989. EXTERNAL
Joe Stewart, "DNS Cache Poisoning - The Next Generation", Jan 27 2003, http://www.lurhq.com/dnscache.pdf . EXTERNAL
CCAIS/RNP Alertas do Cais ALR-19112002a, "Vulnerability in the sending requests control of Bind versions 4 and 8 allows DNS spoofing", http://www.rnp.br/cais/alertas/2002/cais-ALR-19112002a.html . EXTERNAL
CERT Advisory CA-1996-21, "TCP SYN Flooding and IP Spoofing Attacks", Sept 1996. EXTERNAL
CERT Advisory CA-1996-01, "UDP Port Denial-of-Service Attack", Feb 1996. EXTERNAL
CERT Advisory CA-1996-26, "Denial-of-Service Attack via ping", Dec 1996. EXTERNAL
Laurent Joncheray, "Simple Active Attack Against TCP", 5th USENIX Security Symposium, 1995. EXTERNAL
D. Wessels, "Running An Authoritative-Only BIND Nameserver", http://www.isc.org/index.pl?/pubs/tn/ index.pl?tn=isc-tn-2002-2.txt . EXTERNAL
CERT/CC - "Trends in Denial of Service Attack Technology", http://www.cert.org/archive/pdf/DoS_trends.pdf . EXTERNAL
Watson, P., "Slipping in the Window: TCP Reset attacks", Presentation at 2004 CanSecWest, http://www.cansecwest.com/archives.html . EXTERNAL
CERT Advisory CA-2001-09, "Statistical Weaknesses in TCP/IP Initial Sequence Numbers", May 2001. EXTERNAL
T. Aura, P. Nikander, J. Leiwo, "DOS-resistant authentication with client puzzles", In B. Christianson, B. Crispo, and M. Roe, editors, Proceedings of the 8th International Workshop on Security Protocols, Lecture Notes in Computer Science, Cambridge, UK, April 2000. EXTERNAL
IETF RFC 1058 [Active*]
IETF RFC 2349 [Active*]
IETF RFC 3261 [Active*]
IETF RFC 3411 [Active*]
IETF RFC 3550 [Active*]
IETF RFC 3618 [Active*]
IETF RFC 3768 [Superseded*]
IETF RFC 4251 [Active*]
IETF RFC 4566 [Superseded*]

Source Data (JSON)

Full registry record with provenance metadata. Open directly: /api/doc/RFC4732.json

Reference Tree

Explore all references and references to this document, as a navigable tree.

Open Reference Tree

Reference this Doc

Plain text (ISO 690 compliant)

Preview:

IETF RFC 4732, Internet Denial-of-Service Considerations. Available at https://doi.org/10.17487/RFC4732

Snippet:

IETF RFC 4732, Internet Denial-of-Service Considerations. Available at https://doi.org/10.17487/RFC4732

HTML (ISO 690 compliant)

Preview:

IETF RFC 4732, Internet Denial-of-Service Considerations. Available at https://doi.org/10.17487/RFC4732

Snippet:

<span class="citation"><cite>IETF RFC 4732</cite>, Internet Denial-of-Service Considerations. Available at <a href="https://doi.org/10.17487/RFC4732" target="_blank" rel="noopener">https://doi.org/10.17487/RFC4732</a></span>

SMPTE's HTML Pub

Preview:

IETF RFC 4732, Internet Denial-of-Service Considerations
doi: 10.17487/RFC4732
url: https://doi.org/10.17487/RFC4732

Snippet:

<li>
<cite id="bib-rfc4732">IETF RFC 4732</cite>, Internet Denial-of-Service Considerations
<span class="doi">10.17487/RFC4732</span>
</li>

Referenced By

IETF RFC 6120 [Active*]
IETF RFC 6202 [Active*]
IETF RFC 6277 [Superseded*]
IETF RFC 6386 [Active*]
IETF RFC 6716 [Active*]
IETF RFC 6797 [Active*]
IETF RFC 6960 [Active*]
IETF RFC 8075 [Active*]
IETF RFC 8996 [Active*]