WATCHERS: A Protocol to Detect Disruptive Routers

Oct 16, 1998

Abstract

An attractive target for a computer system attacker is the router. An attacker in control of a router can disrupt communication by dropping or misrouting packets passing through the router. I will present a protocol called WATCHERS that detects and reacts to routers that drop or misroute packets. WATCHERS is based on the principle of conservation of flow in a network: all data bytes sent into a node, and not destined for that node, are expected to exit the node. WATCHERS tracks this flow, and detects routers that violate the conservation principle.
After describing WATCHERS in detail, I will discuss the difficult problems that remain before WATCHERS can be implemented.