Stupidly Simple DDoS Protocol (SSDP) Generates 100 Gbps DDoS

Re:Stupidly Simple DDoS Protocol (SSDP) Generates 100 Gbps DDoS by NKCSS on Thursday June 29, 2017 @02:12AM (#14661141)

Because UDP is fire and forget, you don't have to be able to respond to packets you send; this is why you can't do the same with TCP packages.

To impose fixes upstream, you'd have to do DPI on all data; which is not allowed under some laws (i.e. net neutrality).

[ Parent | on HN ]

Re:Stupidly Simple DDoS Protocol (SSDP) Generates 100 Gbps DDoS by sebcat on Thursday June 29, 2017 @03:00AM (#14661327)

In this case, you don't have to care about UDP or TCP, only IP.

RFC2827, which should fix the problem where SSDP can be used for DDoS, was published in 2000: https://tools.ietf.org/html/rfc2827

Is ingress filtering on layer 3 considered DPI?

[ Parent | on HN ]

Re:Stupidly Simple DDoS Protocol (SSDP) Generates 100 Gbps DDoS by mjevans on Thursday June 29, 2017 @03:35AM (#14661452)

I am not this kind of network engineer, HOWEVER. Both IPv4 and IPv6 are versioned by the first 4 bits of the packet. Depending on that value the address size and location are fixed.

I would not consider the comparison of the source address of packets crossing an ingress link to be 'deep'. I consider that check to be very shallow. It needn't even be every packet from a set, merely picking a random (actually random) packet and testing for conformity is a good quality control measure that SHOULD be taken.

What would the comparison be against? Routers are supposed to know which links are on the other side of all down-stream connections so that they can effectively route.

[ Parent | on HN ]

Re:Stupidly Simple DDoS Protocol (SSDP) Generates 100 Gbps DDoS by halloij on Thursday June 29, 2017 @05:16AM (#14661802)

Why would your ISP allow you to send packets with a source address it hasn't allocated to YOU? That kind of check/enforcement is pretty cheap and simple.

[ Parent | on HN ]