On the Effect of Router Buffer Sizes on Low-Rate Denial of Service Attacks

Router queues buffer packets during congestion epochs. A recent result by Appenzeller et al. showed that the size of FIFO queues can be reduced considerably without sacrificing utilization. While Appenzeller showed that link utilization is not affected, the impact of this reduction on other aspects of queue management such as fairness, is unclear. Recently, a new class of low-rate DoS attacks called shrews was shown to throttle TCP connections by causing periodic packet drops. Unfortunately, smaller buffer sizes make shrew attacks more effective and harder to detect since shrews need to overflow a smaller buffer to cause drops. In this paper