Too Big or Too Small? The PTB-PTS ICMP-based Attack against IPsec Gateways
Ludovic Jacquin, Vincent Roca, Jean-Louis Roch · 2014
Abstract—This work introduces the ”Packet Too Big”-”Packet Too Small ” ICMP based attack against IPsec gateways. We explain how an attacker having eavesdropping and packet in-jection capabilities, from the insecure network where he only sees encrypted packets, can force a gateway to reduce the Path MTU of an IPsec tunnel to the minimum, which triggers severe issues for the hosts behind this gateway: depending on the Path MTU discovery algorithm in use, the attack either creates a Denial of Service or major performance penalties. This attack highlights two fundamental problems that we discuss, along with potential counter-measures to mitigate the attack while keeping ICMP benefits. I.