RE: Internal WG Review: Recharter of Next Steps in Signaling (nsis)

[Harald Tveit Alvestrand <harald@alvestrand.no>]

--On onsdag, mai 28, 2003 13:51:03 +0300 john.loughney@nokia.com wrote:

> Hi James,
>
> > In general, this charter looks good, but I've got one question about
> > the security section. In IAB discussions with Ran Atkinson last fall,
> > it came up that one inhibitor for end to end Diffsrv is that it opens
> > a potential DoS attack pathway on the receiving network, in that the
> > attacker can label packets as EF and thereby enhance the effectiveness
> > of the attack (and potentially overwhelm the EF forwarding capacity of
> > the routers). According to Ran, this is a major barrier to QoS
> > deployment among ISPs.
When this was raised on the transport directorate, and again on IAB, I 
asked the following question:

If EF is limited to (say) 25% of the bandwidth, with overflow handled as 
best-effort, does the EF-labelled DOS attack have any significant (>25%) 
advantage at DOSing best-effort services over a best-effort DOS attack?

(of course an EF-labelled DOS attack is more effective than a best-effort 
DOS against EF services)

I still haven't understood an answer.

             Harald