7.3. Denial of Service

A subscription request creates (S,G) state in a router to record the subscription, invokes processing on that router, and possibly causes processing at neighboring routers. A host can mount a denial-of- service attack by requesting a large number of subscriptions. Denial of service can result if:

  - a large amount of traffic arrives when it was otherwise
    undesired, consuming network resources to deliver it and host
    resources to drop it;

  - a large amount of source-specific multicast state is created in
    network routers, using router memory and CPU resources to store
    and process the state; or

  - a large amount of control traffic is generated to manage the
    source-specific state, using router CPU and network bandwidth.

To reduce the damage from such an attack, a router MAY have configuration options to limit, for example, the following items:

  - The total rate at which all hosts on any one interface are
    allowed to initiate subscriptions (to limit the damage caused by
    forged source-address attacks).

  - The total number of subscriptions that can be initiated from any
    single interface or host.

Any decision by an implementor to artificially limit the rate or number of subscriptions should be taken carefully, however, as future applications may use large numbers of channels. Tight limits on the rate or number of channel subscriptions would inhibit the deployment of such applications.

A router SHOULD verify that the source of a subscription request is a valid address for the interface on which it was received. Failure to do so would exacerbate a spoofed-source address attack.

We note that these attacks are not unique to SSM -- they are also present for any-source multicast.