From owner-freebsd-current Thu Dec 3 19:02:37 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id TAA09225 for freebsd-current-outgoing; Thu, 3 Dec 1998 19:02:37 -0800 (PST) (envelope-from owner-freebsd-current@FreeBSD.ORG) Received: from rrz.Hanse.DE (rrz.Hanse.DE [193.174.9.3]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id TAA09218 for ; Thu, 3 Dec 1998 19:02:34 -0800 (PST) (envelope-from stb@hanse.de) Received: from hanse.de (uucp@localhost) by rrz.Hanse.DE (8.8.8/8.8.8) with UUCP id DAA24931; Fri, 4 Dec 1998 03:59:28 +0100 (CET) (envelope-from stb@hanse.de) Received: from transit.hanse.de (transit.Hanse.DE [193.174.9.161]) by daemon.Hanse.DE (8.8.8/8.8.8) with ESMTP id DAA14802; Fri, 4 Dec 1998 03:03:59 +0100 (CET) (envelope-from stb@hanse.de) Received: from localhost (stb@localhost) by transit.hanse.de (8.8.8/8.8.8) with SMTP id DAA12349; Fri, 4 Dec 1998 03:02:07 +0100 (CET) (envelope-from stb@hanse.de) X-Authentication-Warning: transit.hanse.de: stb owned process doing -bs Date: Fri, 4 Dec 1998 03:02:06 +0100 (CET) From: Stefan Bethke To: Matthew Dillon cc: Garrett Wollman , John Saunders , freebsd-current@FreeBSD.ORG Subject: Re: RE: D.O.S. attack protection enhancements commit (ICMP_BANDLIM) In-Reply-To: <199812040034.QAA01418@apollo.backplane.com> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-current@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG On Thu, 3 Dec 1998, Matthew Dillon wrote: > :Just as a side-note: > : > :On Tue, 1 Dec 1998, Matthew Dillon wrote: > : > :> :We should rate-limit ARPs, but don't. > :> > :> ARP's reasonably rate-limited because most subnets are /24's, it's > :> the packets queued up waiting for the ARP to resolve that are the > :... > : > :Actually, arp is already (somewhat) rate-limited. > > Ah, I see. I was thinking of the ARP packets themselves but it makes > to limit the queued packets waiting for ARP to any given destination IP. > > If you have a larger subnet, say a class B, an attacker can spoof > sufficient packets (which the machine then tries to reply to) to cover > the entire class B... 65536 queued packets waiting for ARP, for example. Only if you have a large number of unused addresses; for the used ones, a reply will be received, and subsequently, much less arps will be done. Stefan -- Stefan Bethke Muehlendamm 12 Phone: +49-40-256848, +49-177-3504009 D-22087 Hamburg Hamburg, Germany To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-current" in the body of the message