Subject: Re: [Int-area] introducing a new IPv4 option [was RE: [BEHAVE] Revealing identity of TCP client connection when sharing IPv4 address]

From: Bob Hinden <[email-masked]>
Date: Wed, 8 Sep 2010 12:38:20 -0700

On Aug 31, 2010, at 11:33 AM, Dan Wing wrote:

> A paper was published in 2004 which analyzed the success of new IP options
> and new TCP options,
> 
>  "Measuring Interactions Between Transport Protocols and Middleboxes"
>  Alberto Medina, Mark Allman, Sally Floyd
>  http://conferences.sigcomm.org/imc/2004/papers/p336-medina.pdf
> 
> In Section 4.3, it showed a new IP Option resulted in a 70% connection
> failure, whereas
> Section 4.4 shows a new TCP option resulted in only a 0.2% connection
> failure.  I do 
> not expect things have improved on the Internet for IP options, and my
> testing with 
> nmap to the top 500 websites also has very high failure when sending an TCP
> SYN
> with an IP option.
> 
> Using an IP Option on today's Internet seems unworkable, unless we do
> something
> creative like sending two packets (one with the IP option, one without) and
> react accordingly.  This will probably break UDP-based application protocols
> 
> that don't expect packets to arrive twice, and of course doubles traffic for
> TCP until the address sharing device learns if the server supports or
> rejects
> IP options - which is more state to maintain.
> 
> Are there other ideas for how to successfully introduce a new IP option to 
> the IPv4 Internet?

No.  It's very likely only gotten work since the 2004 paper.

Bob