A DoS-limiting network architecture

Journal Article

We present the design and evaluation of TVA, a network architecture that limits the impact of Denial of Service (DoS) floods from the outset. Our work builds on earlier work on capabilities in which senders obtain short-term authorizations from receivers that they stamp on their packets. We address the full range of possible attacks against communication between pairs of hosts, including spoofed packet floods, network and host bottlenecks, and router state exhaustion. We use simulation to show that attack traffic can only degrade legitimate traffic to a limited extent, significantly outperforming previously proposed DoS solutions. We use a modified Linux kernel implementation to argue that our design can run on gigabit links using only inexpensive off-the-shelf hardware. Our design is also suitable for transition into practice, providing incremental benefit for incremental deployment. Copyright 2005 ACM.

Full Text

Duke Authors

Cited Authors

  • Yang, X; Wetherall, D; Anderson, T

Published Date

  • October 1, 2005

Published In

Volume / Issue

  • 35 / 4

Start / End Page

  • 241 - 252

Electronic International Standard Serial Number (EISSN)

  • 0146-4833

International Standard Serial Number (ISSN)

  • 0146-4833

Digital Object Identifier (DOI)

  • 10.1145/1090191.1080120

Citation Source

  • Scopus