Re: TCP-RST Vulnerability - Doubt

[Florian Weimer <fw@deneb.enyo.de>]

* Miquel van Smoorenburg:

> MD5 protection on BGP sessions isn't very common yet.

Well, there was quite some technology push recently. 8-)

> MD5 uses CPU, and routers don't usually have much of that. Which
> means that now an MD5 CPU attack is possible instead of a TCP RST
> attack.

Anything that is able to send packets to the CPU which runs the TCP
stack can take down your router.  Core routers with 200 MHz MIPS CPUs
are still common.  It really doesn't matter much if you have to do a
MD5 check or not, the CPU will be easy to overload.  However, the TCP
MD5 option is a nice thing to have because you can enable it and avoid
discussions (just like you do it with antivirus software 8-/).

Part of the beauty of the TTL hack is that it actually works in
linecard CPUs or ASICs on some routing architectures, which takes the
load off the main CPU.  For Linux, you can also drop the packets
before they hit the route cache, which might be become more important
in the future when the route cache is no longer used for forwarding.