Subject: RE: Network "edge"

From: Yoram Bernet <[email-masked]>
Date: Mon, 12 Jan 1998 15:26:10 -0800

see below, forward deleted...

> > A slight technicality ... NHRP clients can be present on hosts or
> routers, 
> > hence if the first router is to be bypassed, then the client must be
> present 
> > on the source host which will then be the ``edge'' which marks packets
> for 
> > appropriate service. 
> 
> You are not really suggesting that end-hosts be responsible for marking
> and policing, are you ?
	[Yoram Bernet]  I am.
>  An immediate incentive for end-hosts to
> prioritize all their traffic is to grab more than their fair share of
> _spare_
> bandwidth.
	[Yoram Bernet]  Yes, but - you can police in first hop routers to
prevent them from actually succeeding in doing so. The fact is - there's no
stopping a thief... As soon as app vendors realize that they can get
preferential treatment by setting these bits, they'll work out how to do it.
I am of the opinion that we should give them an OS which secures access to
these bits subject to network policy approval. Of course, the first hop
router will still have to police, but - policing based on TOS bits is a lot
less processing intensive than setting TOS bits based on some arbitrarily
deep classification criteria.
>  I assume there is general consensus that marking and policing 
> should be entrusted to "first-hop" devices, instead of to end-hosts.
	[Yoram Bernet]  There is not. See above comment. We will be
releasing a proposal shortly on how host based signaling and TOS/precedence
bit setting can be integrated with the work in the diff-serv and policy
working groups.

> > However unless you go for one of the many 
> > ``proprietary'' schemes for running NHRP over legacy LANs, most hosts 
> > will be present on legacy LANs without an NHRP client and hence the
> first hop
> > router will not be bypassed.  
> 
> Ahh, this sounds like solution 'a', viz. nhrp wont exist mostly. 
> 
> > In an MPOA based network a convenient ``network edge'' is the LAN
> switch/ 
> > bridge between the host and the first router. Packet marking/
> classification 
> > at this point will allow the first router to be bypassed without 
> > requiring this functionality to be setup in all hosts ... 
> 
> Diff serv was about marking/policing IP traffic. I am not sure if we
> want to make the LAN switch/bridge IP-aware. 
> 
> > > Two solutions seem fairly obvious:
> > > 
> > > a) NHRP wont be around to create this problem :-)
> > > 
> > > b) it is not sufficient to make "first-hop" routers responsible
> > > for marking bits and policing mechanisms. Intermediate routers
> > > should be able to do this if they get traffic from end-hosts. 
> > > 
> > 
> > Not sure what you are suggesting here. 
> > 
> > a. Intermediate routers 
> > are indeed the first hop router for hosts directly connected to them. 
> > Typically one doesn't have routers which do not have any hosts (only 
> > other routers) on directly attached interfaces ...
> 
> You point is true. However, consider an end-host 
> with a first-hop router A. Traditionally, this first-hop router
> would do the necessary marking/policing for this end-host. The
> intermediate router B, which for simplicity reasons can be considered
> to be the egress router to the ISP, provides aggregate control. So to 
> get to the ISP, the end-host has to go thru router A and then router B. 
> 
> But now if the network is NHRP-capable, the end-host can establish a
> direct path to router B. This router however is not capable of
> policing/marking at the end-host level due to the aggregation effect
> that we would like to use as we go away from the network edge. And so we
> need to make these intermediate/egress routers aware of individual
> end-host flows also, which may affect the scalability of the diff
> services scheme.
> 
> hope things are clearer now.
> 
> rajesh.
> 
> 
> -- 
> Rajesh R. Talpade    [email-masked]   973 829-{4261, 5888(fax)}
> Research Scientist, Bellcore, 445, South St, Morristown, NJ-07960

---

From: Rajesh Talpade <[email-masked]>
Date: Mon, 12 Jan 1998 18:51:53 -0500 (EST)

> preferential treatment by setting these bits, they'll work out how to do it.

Doesnt this mean we cant trust end-hosts ?

> bit setting can be integrated with the work in the diff-serv and policy

The only case I can see marking by end-host being useful (other than the
special intra-lan case where everyone is trusted) is if
the end-host wants to indicate to the first-hop device about which
data is more important than other. The first-hop device will still have
to mark/unmark the traffic and do the policing.

Oh well, I look forward to your proposal.

Regards,
Rajesh.