Subject: Re: [arch-d] It's about Information

From: "Fergie" <[email-masked]>
Date: Thu, 7 Dec 2006 08:41:24 GMT

- -- Brian E Carpenter <[email-masked]> wrote:

>>   Also I don't think that shim6 includes the multiple source  addresses 
>> in the packets which led to the complaint that implementing  
>> anti-spoofing was then difficult or impossible.  Or that shim6 had to  
>> do extra work to put the correct source address in the packet so that  
>> anti-spoofing still worked the old way.  But again this complaint was  
>> probably about wanting to do traffic engineering for load balancing  at 
>> the customer ISP interface also.
>
>Well, the tricky issue for shim6 is exit router selection - if ingress
>filtering or RPF checks are in place, sending a packet via the wrong
>exit router is catastrophic.
>

Speaking as one of the authors of BCP 38, yes, it is indeed
tricky. And perhaps, as folks may eventually decide, unacceptable.

Having said that, I would also encourage folks to check-in on 
SAVA:

 http://www.nrc.tsinghua.edu.cn/mailman/listinfo/sava

...where thoughts(very few thus far) on source address verification
in v6 is encouraged. :-)

- - ferg

--
"Fergie", a.k.a. Paul Ferguson
 Engineering Architecture for the Internet
 fergdawg(at)netzero.net
 ferg's tech blog: http://fergdawg.blogspot.com/

_______________________________________________
Architecture-discuss mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/architecture-discuss