[unisog] Practical, Legitimate IP Fragmentation?

John Kristoff jtk at depaul.edu
Fri Mar 14 16:09:01 GMT 2003


On Thu, 13 Mar 2003 22:45:57 -0500
Pascal Meunier <pmeunier at purdue.edu> wrote:

> So, PMTU is just an optimization that opens up some mild to moderate
> security issues.  You decide if it's worth it, and where.  I think

PMTU attacks would generally would have to be aimed at the host being
attacked or they won't work, so this makes them less practical than
other types of attacks.  This involves compromising/spoofing a
router/host on a path the victim uses.

A worm could probably easily be written to inflict PMTU attacks against
entire subnets if it compromised a single host on that subnet, but even
then its probably not very useful to do so in most large-scale attack
scenarios.

> it's unfair to beat on people who decided that it's not worth it,
> perhaps because your favorite application/OS can't deal with a
> situation in which PMTU discovery is broken.  I think that means your
> favorite application/OS is not as robust as you thought.

I don't think anyone is beating on anyone per se.  I think the point is
that its simply not interoperable behavior to block certain types of
packets.  As well intentioned or reasonable as the concerns may be with
some packet types, it is often an attack on innocent users, third
parties and the Internet architecture when valid packets don't get
through.  If those types of packets are of concern, simply blocking them
somewhere in the network may be an easy solution, but often not the best
one.

John



More information about the unisog mailing list