Merit Network
Can't find what you're looking for? Search the Mail Archives.
  About Merit   Services   Network   Resources & Support   Network Research   News   Events   Home

Discussion Communities: Merit Network Email List Archives

North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: Is there a line of defense against Distributed Reflective attacks?

  • From: David G. Andersen
  • Date: Fri Jan 17 13:46:39 2003

On Fri, Jan 17, 2003 at 06:38:08PM +0000, Christopher L. Morrow mooed:
> 
> > has something called Source Path Isolation Engine (SPIE).  There
> 
> This would be cool to see a design/whitepaper for.. Kelly?

The long version of the SPIE paper is at:

  http://nms.lcs.mit.edu/~snoeren/papers/spie-ton.html

The two second summary that I'll probably botch:  SPIE keeps a (very tiny)
hash of each packet that the router sees.  If you get an attack packet, 
you can hand it to the router and ask "From where did this come?"
And then do so to the next router, and so on.  The beauty of the scheme
is that you can use it to trace single-packet DoS or security attacks
as well as flooding attacks.  The downside is that it's hardware.

  -Dave
 
-- 
work: dga@lcs.mit.edu                          me:  dga@pobox.com
      MIT Laboratory for Computer Science           http://www.angio.net/
      I do not accept unsolicited commercial email.  Do not spam me.




Discussion Communities


About Merit | Services | Network | Resources & Support | Network Research
News | Events | Contact | Site Map | Merit Network Home


Merit Network, Inc.