网络工作组m handleyed综合.pdfVIP

RFC4732DoSConsiderationsNovember2006

TableofContents

1.Introduction3

2.AnOverviewofDenial-of-ServiceThreats4

2.1.DoSAttacksonEnd-Systems4

2.1.1.ExploitingPoorSoftwareQuality4

2.1.2.ApplicationResourceExhaustion5

2.1.3.OperatingSystemResourceExhaustion6

2.1.4.TriggeredLockoutsandQuotaExhaustion7

2.2.DoSAttacksonRouters8

2.2.1.AttacksonRoutersthroughRoutingProtocols8

2.2.2.IPMulticast-basedDoSAttacks9

2.2.3.AttacksonRouterForwardingEngines10

2.3.AttacksonOngoingCommunications11

2.4.AttacksUsingtheVictim’sOwnResources12

2.5.DoSAttacksonLocalHostsorInfrastructure12

2.6.DoSAttacksonSitesthroughDNS15

2.7.DoSAttacksonLinks16

2.8.DoSAttacksonFirewalls17

2.9.DoSAttacksonIDSSystems18

2.10.DoSAttacksonorviaNTP18

2.11.PhysicalDoS18

2.12.SocialEngineeringDoS19

2.13.LegalDoS19

2.14.SpamandBlack-HoleLists19

3.AttackAmplifiers20

3.1.MethodsofAttackAmplification20

3.2.StrategiestoMitigateAttackAmplification22

4.DoSMitigationStrategies22

4.1.ProtocolDesign23

4.1.1.Don’tHoldStateforUnverifiedHosts23

4.1.2.MakeItHardtoSimulateaLegitimateUser23

4.1.3.GracefulRoutingDegradation24

4.1.4.AutoconfigurationandAuthentication24

4.2workDesignandConfiguration25

4.2.1.RedundancyandDistributedService25

4.2.2.AuthenticateRoutingAdjacencies25

4.2.3.IsolateRouter-to-RouterTraffic26

4.3.RouterImplementationIssues26

4.3.1.CheckingProtocolSyntaxandSemantics26

4.3.2.ConsistencyChecks27

4.3.3.