Subject: AW: [mobile-ip] A question about 'traceroute'

From: [email-masked]
Date: Tue, 7 Aug 2001 11:58:51 +0200

So, if you have to give an answer, you would say "Traceroute" works with Mobile IP. Is that right?

-----Ursprüngliche Nachricht-----
Von: Kim Taeyong [mailto:[email-masked]]
Gesendet am: Samstag, 28. Juli 2001 04:34
An: [email-masked]
Betreff: Re: [mobile-ip] A question about 'traceroute'

Yes. You are right.
But I  think, To know Intermediate nodes informaiton from HA to FA
is not meaningless for security.

Assume there is bad guy(?) that want to do replay attack or IP packet spoofing...etc.
IF CN know whole node on tunnel, CN can prepare against a possible attack and some bad nodes.

My subject is route tracing of tunnel is significant and certain way to know Intermediate nodes is needed.

----- Original Message ----- 
From: <[email-masked]>
To: <[email-masked]>
Sent: Saturday, July 28, 2001 9:53 AM
Subject: Re: [mobile-ip] A question about 'traceroute'

Hi.

Yes, the question is that whether CN want to know the intermedia nodes in path
from HA to FA where CN's packet is forwarded in tunneling.
I think the MN is always on "Home Network" for CN's point. That's what Mobile IP
provide to nodes. Moreover it is not possible for CN to know where MN is located 
without routing optimization. If so, Intermediate nodes informaiton from HA to FA
is meaningless to CN. I think... 

Regards
Chae-yong

----- Original Message ----- 
From: "Kim Taeyong" <[email-masked]>
To: <[email-masked]>
Sent: Saturday, July 28, 2001 9:30 AM
Subject: Re: [mobile-ip] A question about 'traceroute'

> Dear Chae-yong.
> 
> 
> >> ex)
> >> CN send ICMP packet by incrementing TTL=1, 2, 3, ....(TTL decrease )
> >> Then HA encapsulate ICMP message do not decrease TTL, and send the packet
> >> through the tunnel between HA and FA(TTL decrease )
> >> 
> 
> >Some confusion. "encapsulate ICMP message do not decrease TTL" What does it mean?
> >Does it mean that HA does not decrease the TTL value of original packet?(ICMP echo request)
> 
> >RFC2003 said that the encapsulator decrease the TTL value of inner packet.
> 
> Yes. It's correct. 
> HA encapsulate the packet with reduce TTL of inner packet. 
> Then, encapsulated packet is sended to FA with not reducing TTL of inner packet but outer packet.
> 
> 
> fugure.
> 
> Assume Initial TTL is 4 for inner, outer packet.
>                       
>                                 MN -- FA --node A -- node B -- HA -- CN
> TTL of inner packet :   1        2          2             2           3        4
> TTL of outer packet :                        3             3           4 
> 
> 
> Although, there are some node between HA and FA, more than 1hop, CN knows there is no more node between HA and FA, because TTL of inner packet is decreased by 1.
> 
> 
> Tae-yong
>

---

From: "Kim Taeyong" <[email-masked]>
Date: Wed, 8 Aug 2001 08:32:05 +0900

I think traceroute program can work with Mobile IP but it can not trace
tunneling section.

I think. I do not expriments with mobile IP.

---

From: "alper" <[email-masked]>
Date: Tue, 7 Aug 2001 17:07:33 -0700

run "traceroute mn"

this gives you "ha" and "fa_or_colocated_coa." (look at last two hops before
mn)

now run "traceroute -g ha fa_or_colocated_coa" (-g adds a LSRR to the
probing
packet that has to go through the specified gateway)

now you see what makes up the tunnel.

alper

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]]On Behalf Of Kim Taeyong
Sent: 07 Aðustos 2001 Saly 16:32
To: [email-masked]
Subject: Re: [mobile-ip] A question about 'traceroute'

---

From: "Kim Taeyong" <[email-masked]>
Date: Wed, 8 Aug 2001 09:21:30 +0900

Thanks.

But steel there is some problem.

result of following execution do not guarantee that MN use that route(s) next time.
>packet that has to go through the specified gateway)

To guarantee that,
there must be atomic operation of
"traceroute mn
traceroute -g ha fa_or_colocated_coa"

regards
Tae-yong

---

From: "Chae-yong Chong" <[email-masked]>
Date: Wed, 8 Aug 2001 13:55:41 +0900

I did not test it, however in my understanding I think it will work.

However, I did not test it.

----- Original Message ----- 
From: <[email-masked]>
To: <[email-masked]>
Sent: Tuesday, August 07, 2001 6:58 PM
Subject: AW: [mobile-ip] A question about 'traceroute'

> -----Urspr?gliche Nachricht-----

---

From: georg chambert <[email-masked]>
Date: Wed, 08 Aug 2001 23:43:24 +0200

Hii, would just like to pose a question;
in my understanding this means that there are easy means
to get knowledge of the visited location (ie the FA / coloc)
of the MN, by just anyone interrested.
Could that not be regarded a potential security hazard for&by the moving
individual, i.e. the carrier of the MN?
Rgds
georg

alper wrote:

> Sent: 07 A©£ustos 2001 Saly 16:32

---

From: "Chae-yong Chong" <[email-masked]>
Date: Thu, 9 Aug 2001 09:36:30 +0900

Hi..

I do not know why the location of MN has any security vulnerability.
If a location of some node could be that, why not prohibit sending
"ICMP TTL exceed" message from FA.
I think the location itself does not give any information.

Regards
Chae-yong

---

From: "alper" <[email-masked]>
Date: Wed, 8 Aug 2001 17:49:54 -0700

The problem is at least "privacy". If they know your care-of address,
and if they know which care-of address maps to which geographical area
(they can at least figure this out by going around in town), they
can know where you are.... and people don't want that.

And losing privacy can be exploited for security attacks.

Yes, you can configure your router (FA) not to respond with
time exceeded, and your host (mn) with port unreachable, echo
reply...

alper

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]]On Behalf Of Chae-yong Chong
Sent: 08 Aðustos 2001 Çarþamba 17:37
To: [email-masked]
Subject: Re: [mobile-ip] A question about 'traceroute'

Hi..

Regards
Chae-yong

---

From: "Chae-yong Chong" <[email-masked]>
Date: Thu, 9 Aug 2001 10:11:03 +0900

Hi

Does that geographic area information is applied to any IP network?
Why geographic are information should be considered for Mobile Node specially?

If MN want to have some "privacy", it should use Private Address with Mobile IP.

---

From: georg chambert <[email-masked]>
Date: Thu, 09 Aug 2001 11:44:13 +0200

Yes, this is the kind of problems I'm thinking of.

If I understand correct what you say, then;
you can as a MN owner depend on (or select) access network operators
that are setting up their FA  not to respond,
and so be safe that no address information revealing anything about
location is possible to retrieve.

Tnx for your answers & Rgrds
Georg

---

From: John Wells <[email-masked]>
Date: Thu, 9 Aug 2001 10:31:59 -0400

Alper,

It's a pretty difficult problem.  HMIP is one way of solving it, in that
it hides the CoA within a site, but isn't ideal, since correspondent
nodes and observers know it's within a site.

I tried to come up with a better solution (see
http://www.ee.vt.edu/~wells), but the problem is that to hide the
address for two-way live communication, there must be an intermediary to
hide the address.  Essentially, I made this intermediary like a MAP in
basic mode, and forced two way tunnelling, so the client (which acts
like an HMIP mobile node) only communicates with this address bound at
the intermediary, hopefully not giving any location information.  It
seems a bit heavyweight which is why I haven't written a draft on it.

Has anyone else done any work on lightweight location privacy in v6?  I
could only find heavyweight solutions requiring special changes in lots
of machines, sometimes including intermediate routers.

john

-- 
John WELLS
Virginia Tech Networking and Visualization Lab
PGP Public key: http://www.ee.vt.edu/~wells/pgpkey.txt

---

From: John Wells <[email-masked]>
Date: Thu, 9 Aug 2001 10:37:27 -0400

Chae-yong,

By private addresses, do you mean RFC 3041 privacy extension for
stateless autoconf addresses?  The link address part (last 64 bits)
change every so often, but the link itself does not change.  For fixed
nodes, this is probably sufficient to foil eavesdroppers, but it's not
sufficient when you communicate for a long time with a correspondant
node, or login to a correspondant node server.  There, the CN can bind
your location (the network id which cannot be hidden) with your name,
address, email, or whatever info you give it.

There's still the question of hiding the home address too, which is
not covered in the 3041 privacy extensions.  There's a draft on this:
draft-castelluccia-mobileip-privacy-00.txt.

john