Too Big or Too Small? The PTB-PTS ICMP-based Attack against IPsec Gateways - Inria - Institut national de recherche en sciences et technologies du numérique Access content directly
Conference Papers Year : 2014

Too Big or Too Small? The PTB-PTS ICMP-based Attack against IPsec Gateways

Abstract

This work introduces the "Packet Too Big"-"Packet Too Small" ICMP based attack against IPsec gateways. We explain how an attacker having eavesdropping and packet injection capabilities, from the insecure network where he only sees encrypted packets, can force a gateway to reduce the Path MTU of an IPsec tunnel to the minimum, which triggers severe issues for the hosts behind this gateway: depending on the Path MTU discovery algorithm in use, the attack either creates a Denial of Service or major performance penalties. This attack highlights two fundamental problems that we discuss, along with potential counter-measures to mitigate the attack while keeping ICMP benefits.
Fichier principal
Vignette du fichier
globecom14_ptb-pts_attack.pdf (240.04 Ko) Télécharger le fichier
Origin : Files produced by the author(s)
Loading...

Dates and versions

hal-01052994 , version 1 (29-07-2014)

Identifiers

  • HAL Id : hal-01052994 , version 1

Cite

Ludovic Jacquin, Vincent Roca, Jean-Louis Roch. Too Big or Too Small? The PTB-PTS ICMP-based Attack against IPsec Gateways. IEEE Global Communications Conference (GLOBECOM'14), John Donovan (general chair), Dec 2014, Austin, United States. ⟨hal-01052994⟩
410 View
727 Download

Share

Gmail Facebook X LinkedIn More