Exploiting the Congestion Control Behavior of the Transmission Control Protocol

This paper presents a realistic method for exploiting an already known insecurity of the congestion control behavior of the transmission control protocol that was originally pointed out in 1999 and that affects all known TCP implementations. This insecurity exploits the fundamental assumption of TCP that the communicating remote end is trustworthy and is behaving correctly. We developed a methodology and an algorithm which we used to attack a Web server and deceive it in transmitting with a constant rate of 900 Mbits per second. During the attack the server was incapable of reacting to the network congestion it caused.