Subject: RE: ["John Brezak" <[email-masked]>] RE: [extensibility 3a] Explanation of issues arrising when you have multiple implementations sharing ccache

From: "John Brezak" <[email-masked]>
Date: Thu, 6 Dec 2001 14:10:34 -0800

Many firewalls will not allow fragmented udp traffic (at least people
configure them this way). In addition there are many products out that
do not handle fragmented udp traffic. Yes you can push them to fix it,
but that tends to be very problematic.

Because of this many customers have had to require TCP only.

-----Original Message-----
From: Douglas E. Engert [mailto:[email-masked]] 
Sent: Thursday, December 06, 2001 12:59 PM
To: John Brezak
Cc: Sam Hartman; [email-masked]
Subject: Re: ["John Brezak" <[email-masked]>] RE:
[extensibility 3a] Explanation of issues arrising when you have multiple
implementations sharing ccache

John Brezak wrote:
> 
>
> Sounds like more justification to make TCP required.

What I ment, was they tickets work fine, it was the intrusion detector
which 
had the bug, and did not recognize the fragmented UDP packets.  

If you mean fragmented UDP packets are so rare, that other routers, IP
stacks or intrusion detectors may have problems, then I agree. 

> 
> -----Original Message-----
> From: Douglas E. Engert [mailto:[email-masked]]
> Sent: Thursday, December 06, 2001 12:04 PM
> To: Sam Hartman
> Cc: [email-masked]
> Subject: Re: ["John Brezak" <[email-masked]>] RE: 
> [extensibility 3a] Explanation of issues arrising when you have 
> multiple implementations sharing ccache
> 
> Sam Hartman wrote:
> >
> > Good point.
> >
> > ------- Start of forwarded message -------
> > MIME-Version: 1.0
> > Content-Type: text/plain;
> >         charset="us-ascii"
> > Content-Transfer-Encoding: quoted-printable
> > Subject: RE: [extensibility 3a] Explanation of issues arrising when 
> > you have multiple implementations sharing ccache
> > Date: Thu, 6 Dec 2001 09:19:18 -0800
> > Message-ID:
> <[email-masked]
> y.
> ntdev.microsoft.com>
> > From: "John Brezak" <[email-masked]>
> > To: "Sam Hartman" <[email-masked]>
> >
> > Something else to consider. With the duplicate contents in the 
> > messages, there is going to be a good chance these will not 
> > successfully fit though a single non-fragmented UDP datagram. The 
> > TCP transport should now be required.
> 
> We have already seen this with W2K generatesd UDP tickets, and AFS 
> packets. We had a intrusion detector which did not check the UDP 
> fragmentation correctly
> and was flaging these. So it might be a mute point, as Tickets are
> already being framented.
> 
> --
> 
>  Douglas E. Engert  <[email-masked]>
>  Argonne National Laboratory
>  9700 South Cass Avenue
>  Argonne, Illinois  60439
>  (630) 252-5444

-- 

 Douglas E. Engert  <[email-masked]>
 Argonne National Laboratory
 9700 South Cass Avenue
 Argonne, Illinois  60439 
 (630) 252-5444