Re: Sessions Resource Exhaustion

On 10/13/07, Ravi Chunduru <ravi.is.chunduru@xxxxxxxxx> wrote:
On 10/12/07, H D Moore <sflist@xxxxxxxxxxxxxxxxxx> wrote:
If you can fill the state table using just SYN packets (without doing a
full session setup), then the device in question is just crap :-)

i could not exhaust state tables with TCP. I sent UDP:500 traffic
with different source ports to fill up the state table. It makes me
wonder whether may stateful devices are vulnerable to these kinds of
attacks.

UDP may be stateless, but the moment an IPS receives an UDP packet
with some content it would have to initialize and maintain a session
for that packet because the signature matching and other checks have
to kick in. So it is not surprising that you could fill up the state
table with UDP:500 traffic. It is easier to spoof UDP packets than
complete the 3-way TCP handshake, so you may have been able to fill up
the table faster too.

However in your deployment scenario, would you really be allowing
incoming UDP traffic or would your firewall be dropping them before it
is seen by the IPS?

Rahul

------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw
to learn more.
------------------------------------------------------------------------

Relevant Pages

  • Re: Sessions Resource Exhaustion
    ... Is it not common to have IPsec VPN Server in typical network deployments? ... full session setup), then the device in question is just crap :-) ... but the moment an IPS receives an UDP packet ...
    (Focus-IDS)
  • Re: Ethernet base protocols on embedded
    ... base communication on my embedded device. ... encapsulate each entire RS485 message in a UDP packet to the host (or ... those through a TCP session. ... or send each message as a UDP packet. ...
    (comp.arch.embedded)
  • Re: how exactly UDP tunneling works...
    ... >UDP over TCP which to me it means that you put a TCP stream in a UDP packet ...
    (microsoft.public.win32.programmer.networks)
  • Re: "established" on { tcp or udp } rules
    ... sure back in the 4.x days when I started using ipfw that it would error ... out with something along the lines of "TCP options can't be used with UDP ... Matches TCP packets that have the RST or ACK bits set. ... it is obvious that udp packet will not match and thus entire rule will not ...
    (freebsd-net)
  • Re: UDP applet
    ... I thought a regular applet could communicate with its server through ... tcp or udp. ... It seems to me that it can only send udp packet but not receive any ...
    (comp.lang.java.programmer)