lkml.org 
[lkml]   [2004]   [Jun]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: TCP-RST Vulnerability - Doubt
    From
    Date
    On Mon, 28 Jun 2004 21:26:07 +0200, Florian Weimer said:

    > > The Cisco routers we deployed 3.5 years ago were already configured with MD
    5
    > > enabled on BGP, this was on IOS 12.0 at this time. And I guess that Cisco
    > > still has a good share amongst the BGP setups.
    >
    > Software deployed /= configured & enabled.
    >
    > One of the main problems with the TCP MD5 option is that it requires a
    > password which has to be negotiated by the peers. This adds a
    > non-trivial management burdern.

    The latest numbers I saw on the NANOG list estimated that only 30% to 40% of
    core peerings were using MD5 even several weeks after the Great MD5-Fest...

    > If the packet is still handled by a real CPU (which is very likely the
    > case given the complexity of the protocols involved), it will still
    > overload.

    I am told that at least some versions of IOS got it Very Very Wrong - rather
    than first checking the simple things like "is the source/dest addr/ports/seq
    on the RST in bounds?" or "is a BGP packet?", it would check the MD5 *first* -
    meaning you could swamp the real CPU by sending it a totally bogus stream of
    allegedly MD5-signed traffic.. which of course would induce a route flap
    when the CPU fell too far behind... ;)
    [unhandled content-type:application/pgp-signature]
    \
     
     \ /
      Last update: 2005-03-22 14:04    [W:0.025 / U:62.308 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site