Subject: RE: [Tsvwg] Congestion window init

From: [email-masked]
Date: Wed, 20 Mar 2002 16:17:51 +0200

Hi Arun!
 
    Nice to hear that there are people around reading my Thesis... :-)

-----Original Message-----
From: ext Arun Prasad [mailto:[email-masked]]
Sent: 20. March 2002 12:42
To: Arias-Rodriguez Ivan (NRC/Helsinki)
Cc: [email-masked]; [email-masked]
Subject: Re: [Tsvwg] Congestion window init

Hi Ivan, 
    Ya, I got ur point.... thanks for that....... 

[Arias-Rodriguez Ivan (NRC/Helsinki)] Not at all...

     I have one more question for you... 

From your thesis  "Stream Control Transmission Protocol .The design of a new reliable transport protocol for IP networks" : 

"An attacker could easily send us any of those ICMP messages to affect our 
sending capabilities reducing our throughput. Therefore, the SCTP header was 
designed so the Verification Tag is present in the ICMP messages. When 
processing a received ICMP packet, the association affected is determined by 
using the Source Address and Destination Address fields (carried in the IP header 
inside the ICMP message), and the Source Port Number and Destination Port 
Number (carried in the first 4 bytes of the SCTP header also included in the ICMP 
message). Then, to validate that this ICMP packet was not sent by an attacker, the ICMP message is validated by comparing the SCTP 
Verification Tag also carried in the ICMP message and checking that it is 
the right one." 

    The Verification Tag validation, which is specified above should be mentioned 
in the RFC .... atleast with a MAY condition right.....( I think I didnt miss this in 
the Rfc)..... 

[Arias-Rodriguez Ivan (NRC/Helsinki)] No, there is nothing in the RFC regarding ICMP.

    Well, in that paragraph I was trying to explain why the common header has that shape, with the port numbers and VT in the first 8 bytes. There are some ICMP messages that could affect SCTP such as the "Source Quench" message (I haven't seen any though) and the "Fragmentation Needed and DF Set"/"Packet Too Big".

    I don't worry about "Source Quench" messages, but the second type is used in the MTU Discovery algorithm. I validate the incoming packet, but, I don't think there should be anything in the RFC. This is the interaction between SCTP and ICMP... TCP doesn't say anything about this either, but it is true that TCP does not have anything such as the VT to avoid this... :-/

      Since the point of validating the VTag for an ICMP message is very important 

[Arias-Rodriguez Ivan (NRC/Helsinki)] Well... "very important"... I don't know...

    However, in fact there was a discussion when the final shape of the Common Header was designed (previously the checksum bytes where inside those 8 first bytes), because of these ICMP messages. Otherwise an attacker could lower our MTU to its minimum, damaging our throughput and the efficiency of our transmission...

 ( in terms of an attacker...) the implementer of the SCTP should be informed about 
validating it right!!! 

[Arias-Rodriguez Ivan (NRC/Helsinki)] I don't know what the rest of the people think, but I'm unsure that this should be included in the RFC. I have always thought that this was kind of (let me use this expression) "common sense practice"...

    Thanks!!!

    BR Iván Arias Rodríguez

 Thanks 
-arun 

_______________________________________________
tsvwg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tsvwg

---

From: "Iain.Thomson" <[email-masked]>
Date: Thu, 28 Mar 2002 08:37:50 -0000

Randall,
small comment below
Iain
=========================
  Iain Thomson   
  Thales Research Ltd                                   
  [email-masked]    
=========================

-----Original Message-----
From: Randall Stewart [mailto:[email-masked]]
Sent: Wednesday, March 27, 2002 2:32 PM
To: Arun Prasad
Cc: [email-masked]; [email-masked]
Subject: Re: [Tsvwg] Congestion window init

Randall wrote:
>A couple of observations:
>
>1) If your peer is limiting you to 1500 bytes no matter if
>   you are in slow-start or CA you are stuck sending only one
>   segment at a time.
>
>2) You can never grow your cwnd if your peer limits the rwnd
>   below the value of cwnd.

With TCP the cwnd grows according to the received ACKs and so may grow very large but the number of bytes that can be sent will still be limited by the size of rwnd. Is SCTP different? I think its RFC 2861 (TCP Congestion Window Validation) that has a useful discussion on this.

>So I don't think it makes any difference in this case that
>you set it and entered CA right away.. you are not going
>to have very good performance due to the strict limitiation
>of the peers rwnd.

*******************************************************************************
This email and any files transmitted with it are intended solely for the use of
the individual or entity to whom they are addressed and may not be divulged to
any third party without the express permission of the originator.  Any views
expressed in this message are those of the individual sender, except where the
sender specifically states them to be the views of Thales Research Ltd.

Following the acquisition of Racal Electronics plc by Thomson-CSF, please note
that our new name is Thales Research Ltd.  For more information regarding the
Thales Group (formerly Thomson-CSF) please see our website www.Thalesgroup.com
*******************************************************************************