Subject: RE: [Sip] draft-jennings-sip-dtls

From: "Christian Stredicke" <[email-masked]>
Date: Thu, 17 Feb 2005 21:00:31 +0100

16 bit set an upper limit of 64 K connections. My feeling is that TCP
was not designed for this purpose.
 
Sorry for being so pragmatic. Maybe someone can show me an
implementation that can handle 100 K connections on one IP address.
 
CS

________________________________

	From: Tolga Asveren [mailto:[email-masked]] 
	Sent: Thursday, February 17, 2005 8:16 PM
	To: Christian Stredicke; Francois Audet; Cullen Jennings;
Jonathan Rosenberg
	Cc: [email-masked]
	Subject: RE: [Sip] draft-jennings-sip-dtls

	Isn't "running out of sockets" an implementation issue rather
than a protocol one? 
	 
	And I believe using multiple processes would solve that problem.
	 
	  Tolga

		-----Original Message-----
		From: [email-masked]
[mailto:[email-masked]]On Behalf Of Christian Stredicke
		Sent: Wednesday, February 16, 2005 5:02 PM
		To: Francois Audet; Cullen Jennings; Jonathan Rosenberg
		Cc: [email-masked]
		Subject: RE: [Sip] draft-jennings-sip-dtls

		Today I would recommend SIP operators to avoid TCP (and
that includes TLS) because the processes are simply running out of
sockets (think about an ITSP with one million customers). The UDP/DTLS
idea would make it reasonable simple to have much more connections and
on top have security. And as far as I understood the dtls it finally
does solve the fragmentation pain problem.
		 
		That sounds like a great thing to me. I would vote for
dtls!
		 
		CS

________________________________

			From: [email-masked]
[mailto:[email-masked]] On Behalf Of Francois Audet
			Sent: Wednesday, February 16, 2005 9:47 PM
			To: 'Cullen Jennings'; 'Jonathan Rosenberg'
			Cc: [email-masked]
			Subject: RE: [Sip] draft-jennings-sip-dtls

			I would agree with Jonathan.
			 
			Yes, some implementations of SIP/TCP have
performance issues compared to SIP/UDP, but not necessarily all of them.

			Also, if we need to address the other problems
of UDP transport (like fragmentation, and others), then it is not clear
to me that we are saving much in the first place by using UDP/DTLS
instead of TCP/TLS.
			 
			I'd like to see real data before we add yet
another thing we'll have to implement...

				-----Original Message-----
				From: [email-masked]
[mailto:[email-masked]] On Behalf Of Cullen Jennings
				Sent: Tuesday, February 15, 2005 20:08
				To: Jonathan Rosenberg
				Cc: [email-masked]
				Subject: Re: [Sip]
draft-jennings-sip-dtls

				Oops - I meant to put that.... There is
pretty much one key thing. No one has build an single edge proxy that
can terminate 100k to 1M connections to UAs using TLS. In theory it is
possible, but in practice it seems hard. The argument is that this will
be easier with DTLS. The issue is not the time it takes to do the crypto
- session resumption deals with that nicely - it just the issues of
dealing with half a million TCP connections to one box. Of course no one
has done it with DTLS either :-)
				
				I believe the argument we made for SCTP
was that adding an extensions for SCTP won't increase the complexity of
things that don't support SCTP. 
				
				I agree the UDP/TCP complexity made SIP
more complicated and I agree that sip and sips made things more
complicated. I'm not sure I buy that both TLS and TCP made things more
complicated. 

				On 2/15/05 7:15 PM, "Jonathan Rosenberg"
<[email-masked]> wrote:

				Cullen, 
				
				What seems missing to me from this is
requirements and problem 
				statements. What is DTLS doing for us
that we don't get from TLS? 
				
				Though SIP can run over many different
transport protocols, I think 
				experience over time has shown that more
choices here is not necessarily 
				a good thing, as SIP has a fair bit of
complexity as a result of dealing 
				with the differences between UDP and
TCP. As such, I don't think its a 
				good idea to just add more transport
protocols to SIP's list of 
				supported ones unless there is a
compelling problem that it is solving. 
				
				Thanks, 
				Jonathan R. 
				
				Cullen Jennings wrote: 
				
				> 
				> Nagendra and I put together a draft on
using DTLS with SIP. Until it 
				> shows up in the archives you can find
it at 
http://scm.sipfoundry.org/rep/ietf-drafts/fluffy/draft-jennings-sip-dtls
-00.html 
				> 
				> (there is a .txt version too) 
				> 
				> 
				> The abstract is: 
				> 
				>    This draft specifies how to use
Datagram Transport Layer Security 
				>    (DTLS) as a transport for SIP.
DTLS is a new protocol for providing 
				>    TLS security over a datagram
protocol. 
------------------------------------------------------------------------

_______________________________________________ 
				> Sip mailing list
https://www1.ietf.org/mailman/listinfo/sip 
				> This list is for NEW development of
the core SIP Protocol 
				> Use [email-masked]
for questions on current sip 
				> Use [email-masked] for new
developments on the application of sip 

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Dean Willis <[email-masked]>
Date: Thu, 17 Feb 2005 18:40:57 -0600

> implementation that can handle 100 K connections on one IP address.

Actually, we fairly thoroughly flogged this topic a few years ago.

The net-net was that the 64k limit is a kernel limit, induced by the 
use of 16-bit indices in file descriptor tables and other places.

Some kernels (or embedded IP limitations that are not kernel specific) 
don't seem to have this limitation. I'm told by some of the bootserver 
engineers I talk with occasionally that they can get several hundred 
thousand TCP connections on Solaris 9, at a cost of about 4kB per 
connection. Of course, this eats a boatload of RAM.

But DTLS does have some nice properties, and its ability to scale 
larger on a larger set of OS platforms is quite possibly one of them.

--
Dean

---

From: "Tolga Asveren" <[email-masked]>
Date: Fri, 18 Feb 2005 08:39:51 -0500

Message<Actually this becomes too implementation dependent, probably need to
switch to implementors list, but just because it is about the
existence/non-existence of certain limitation which might be an argument in
favor of a new proposal, I continue here>

Why is there a limitation because of 16 bit (I assume you are referring to
local/remote port field length in TCP header)? When the server side calls
"accept", a new socket will be assigned but no extra port is consumed.

And yes, there are ways to support the case you mentioned -with one IP
Address/port pair-.

Don't get me wrong, obviously the protocol needs to be implementable, but I
personally do not see a problem related with that issue, neither in TCP
protocol nor how to achieve the desired functionality in mainstream OS.

        Tolga
  -----Original Message-----
  From: [email-masked] [mailto:[email-masked]]On Behalf Of
Christian Stredicke
  Sent: Thursday, February 17, 2005 3:01 PM
  To: Tolga Asveren; Francois Audet; Cullen Jennings; Jonathan Rosenberg
  Cc: [email-masked]
  Subject: RE: [Sip] draft-jennings-sip-dtls

  16 bit set an upper limit of 64 K connections. My feeling is that TCP was
not designed for this purpose.

  Sorry for being so pragmatic. Maybe someone can show me an implementation
that can handle 100 K connections on one IP address.

  CS

----------------------------------------------------------------------------
    From: Tolga Asveren [mailto:[email-masked]]
    Sent: Thursday, February 17, 2005 8:16 PM
    To: Christian Stredicke; Francois Audet; Cullen Jennings; Jonathan
Rosenberg
    Cc: [email-masked]
    Subject: RE: [Sip] draft-jennings-sip-dtls

    Isn't "running out of sockets" an implementation issue rather than a
protocol one?

      Tolga
      -----Original Message-----
      From: [email-masked] [mailto:[email-masked]]On Behalf Of
Christian Stredicke
      Sent: Wednesday, February 16, 2005 5:02 PM
      To: Francois Audet; Cullen Jennings; Jonathan Rosenberg
      Cc: [email-masked]
      Subject: RE: [Sip] draft-jennings-sip-dtls

      Today I would recommend SIP operators to avoid TCP (and that includes
TLS) because the processes are simply running out of sockets (think about an
ITSP with one million customers). The UDP/DTLS idea would make it reasonable
simple to have much more connections and on top have security. And as far as
I understood the dtls it finally does solve the fragmentation pain problem.

      That sounds like a great thing to me. I would vote for dtls!

      CS

        From: [email-masked] [mailto:[email-masked]] On Behalf
Of Francois Audet

        Yes, some implementations of SIP/TCP have performance issues
compared to SIP/UDP, but not necessarily all of them.

        Also, if we need to address the other problems of UDP transport
(like fragmentation, and others), then it is not clear to me that we are
saving much in the first place by using UDP/DTLS instead of TCP/TLS.

        I'd like to see real data before we add yet another thing we'll have
to implement...
          -----Original Message-----
          From: [email-masked] [mailto:[email-masked]] On Behalf
Of Cullen Jennings
          Sent: Tuesday, February 15, 2005 20:08
          To: Jonathan Rosenberg
          Cc: [email-masked]
          Subject: Re: [Sip] draft-jennings-sip-dtls

          Oops - I meant to put that.... There is pretty much one key thing.
No one has build an single edge proxy that can terminate 100k to 1M
connections to UAs using TLS. In theory it is possible, but in practice it
seems hard. The argument is that this will be easier with DTLS. The issue is
not the time it takes to do the crypto - session resumption deals with that
nicely - it just the issues of dealing with half a million TCP connections
to one box. Of course no one has done it with DTLS either :-)

          I believe the argument we made for SCTP was that adding an
extensions for SCTP won't increase the complexity of things that don't
support SCTP.

          I agree the UDP/TCP complexity made SIP more complicated and I
agree that sip and sips made things more complicated. I'm not sure I buy
that both TLS and TCP made things more complicated.

          On 2/15/05 7:15 PM, "Jonathan Rosenberg" <[email-masked]>
wrote:

            Cullen,

            What seems missing to me from this is requirements and problem
            statements. What is DTLS doing for us that we don't get from
TLS?

            Though SIP can run over many different transport protocols, I
think
            experience over time has shown that more choices here is not
necessarily
            a good thing, as SIP has a fair bit of complexity as a result of
dealing
            with the differences between UDP and TCP. As such, I don't think
its a
            good idea to just add more transport protocols to SIP's list of
            supported ones unless there is a compelling problem that it is
solving.

            Thanks,
            Jonathan R.

            Cullen Jennings wrote:

            >
            > Nagendra and I put together a draft on using DTLS with SIP.
Until it
            > shows up in the archives you can find it at
            >
            >
http://scm.sipfoundry.org/rep/ietf-drafts/fluffy/draft-jennings-sip-dtls-00.
html
            >    This draft specifies how to use Datagram Transport Layer
Security
            >    (DTLS) as a transport for SIP.  DTLS is a new protocol for
providing
            >    TLS security over a datagram protocol.
            >
            >