CS 495 Advanced Networking David R. Choffnes, Spring 2005 Denial of Service Resilience in Ad Hoc Networks Imad Aad, Jean-Pierre Hubaux, Edward W. Knightly (EPFL & Rice) Appears in: MobiCom ’04 Presented by: David R. Choffnes

2 Outline Ranting More Ranting Zombies Ranting

3 JellyFish Attacks Requires a closed-loop protocol, like TCP –But we’ve already discussed paper detailing how TCP doesn’t work well for ad hoc networks –How do protocol-compliant attacks work on cross- layer protocols? Not specific to ad-hoc networks –E.g., periodic dropping –It would be nice to compare performance against wired networks in these cases Can actually help the system when it is overloaded!

4 Methodology: Attacks without Solutions Exploring impact of attacks without considering solutions lessens validity of results Authors do not consider more interesting scenarios such as hybrid environments (more than one TCP implementation) Even though nodes are protocol compliant, anomalous complete TCP collapse or significant reduction in performance is not hard to detect Seems to rely too much on cross-layer independence

5 Misbehavior Diagnosis PACK limitations –Power management not likely in highly mobile scenarios –Directional antennae not widely deployed yet, not necessarily true that they will be anytime Diagnosis time: order of seconds –No results back up the claim –How does this change with different routing protocols?

6 Modeling and Simulation Mean route lifetime: 10s –Why not look at a range of mean lifetimes corresponding to real scenarios? Simulation environment –Open field of 1.2 square miles! –200 nodes moving randomly! (Shaun of the Dead) –Maximum velocity of 10 m/s (Most people can’t run much faster than 3 m/s, esp. with a computer in hand, browsing the Web or using FTP) –Receive range of 250m is ridiculously unrealistic

7 More issues with Experiments To what realistic scenario does the network traffic correspond? Figure 16: large radio range inhibits fairness measurement, but the authors do not consider reducing the radio range Only one routing protocol evaluated –How does JF impact AODV? –How about location-based routing protocols? –Cross-layer reliable delivery protocols?

8 Finally… This is NOT the Internet –These are mobile scenarios, where all computers are relatively close to each other and in an open field –Malicious attacker cannot simply hide behind a bush –No doubt there are techniques to locate the JF attacker and physically remove her from the network