Subject: [Sip] Comments on draft-ietf-sip-session-timer-12

From: Paul Kyzivat <[email-masked]>
Date: Thu, 23 Oct 2003 16:40:21 -0400

I have a couple of comments on this, one serious, the other editorial.

The serious one: In 7.1, 2nd to last paragraph:

    A UAC MAY include a Session-Expires in an initial session refresh
    request if it wishes for a session timer to be applied to the
    session. The value of this header field indicates the session
    interval desired by the UAC.  If a Min-SE header is included in the
    initial session refresh request, the value of the Session-Expires
    MUST be equal to the value in Min-SE.

This can't be right. This says that if the UAC wants to specify a value 
then no negotiation about the value is possible. This first appeared in 
v-11. I would suggest a fix, but I can't figure out what the intent was.

Surely it should be ok for the UAC to include a Min-SE, and a 
Session-Expires with a value greater than that in Min-SE, thus giving 
the proxies and the UAS an opportunity to set Min-SE higher or 
Session-Expires lower.

The editorial one: In the introduction, the following paragraphs:

    This refresh mechanism has additional applications. For the same
    reasons a call stateful proxy server would like to determine whether
    the session is still active, a user agent would like to make this
    determination. This determination can be made at a user agent without
    the use of SIP level mechanisms; for audio sessions, periodic RTCP
    packets serve as an indication of liveness [5]. However, it is
    desirable to separate SIP session liveness from the details of the
    particular session.

    Another application of the session timer is in the construction of a
    SIP Network Address Translator (NAT) Application Level Gateway (ALG)
    [6]. The ALG embedded in a NAT will need to maintain state for the
    duration of a call. This state must eventually be removed. Relying on
    a BYE to trigger the removal of state, besides being unreliable,
    introduces a potential denial of service attack.

are really pointless. A UA doesn't need session timer to refresh 
sessions - it can send a reINVITE or UPDATE whenever it is curious. And 
the ALG must either be a proxy (in which case it falls within the 
primary purpose of session timer), or else it is a B2BUA (in which case 
it is a UA and can refresh on its own.) So neither of these is really an 
additional application of the mechanism. I think both paragraphs can be 
removed.

Otherwise this looks good to me.

	Paul

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip