The Taming of the Shrew

The Shrew attack is a denial of service attack wherein a rogue end-system periodically generates a high-bandwidth “spike” in order to cause TCP senders to experience loss simultaneously, synchronize their retransmissions, and ultimately experience congestive collapse. Because these spikes are periodic, overall the Shrew is a low bandwidth flow and difficult to detect and police. Currently, the best known counter-measures for Shrew attacks require modifications to the protocol stack on end-systems. In this work we show how a form of active queue management (AQM) can effectively eliminate the threat posed by Shrew attacks. We show that Differential Congestion Notification, an AQM scheme developed to improve response time of interactive traffic, “tames” the Shrew. Using a laboratory network testbed emulating traffic sources found on a campus link, we show that DCN eliminates the ill effects of a variety of Shrew attacks including a distributed attack. This study demonstrates that while Shrew attacks are indeed a real threat, such attacks are naturally countered by using AQM schemes that already improve the performance of the majority of TCP flows.