Subject: Re: [Tsvwg] ICMP issue with SCTP IG

From: "Schruefer, Wolfgang" <[email-masked]>
Date: Thu, 22 Sep 2005 14:07:41 +0200

Brian,

as a client I would send immeadately n Heartbeats, where n is the number of my local adresses. Then the server could verify all paths immediately. I think that would work better than some other solution ...

Wolfgang

> -----Ursprüngliche Nachricht-----
> Von: Brian F. G. Bidulock [mailto:[email-masked]] 
> Gesendet: Donnerstag, 22. September 2005 14:00
> An: Schruefer, Wolfgang
> Cc: Randall Stewart; Michael Tuexen; [email-masked]; Vlad 
> Yasevich; Kacheong Poon; Scott Bradner; Coene, Lode
> Betreff: Re: [Tsvwg] ICMP issue with SCTP IG
> 
> Wolfgang,
> 
> It wouldn't work too well for highly asymmetrical data exchange (e.g.
> one keystroke transfers a 1Gb file).  The server sending the 
> 1Gb file would not have any opportunity to receive data to 
> trigger verification, but may have a pressing need to use 
> alternate addresses to transfer the 1Gb file due to, say, a 
> legitimately failed primary.
> 
> --brian
> 
> 
> On Thu, 22 Sep 2005, Schruefer, Wolfgang wrote:
> 
> > Hi,
> > 
> > seems that the discussion circled around the question, 
> which behaviour is a worse amplification than the other ... 
> so I would suggest an alternative method:
> > 
> > Use incoming packets (HEARTBEATS or DATA) as trigger for 
> sending path verification heartbeats. I think that is easy to 
> implement and can not produce amplification??? 
> > 
> > Best regards
> > Wolfgang
> > 
> > 
> > 
> > > -----Ursprüngliche Nachricht-----
> > > Von: Brian F. G. Bidulock [mailto:[email-masked]]
> > > Gesendet: Donnerstag, 22. September 2005 13:38
> > > An: Randall Stewart
> > > Cc: Michael Tuexen; [email-masked]; Vlad Yasevich; Schruefer, 
> > > Wolfgang; Kacheong Poon; Scott Bradner; Coene, Lode
> > > Betreff: Re: [Tsvwg] ICMP issue with SCTP IG
> > > 
> > > Randall,
> > > 
> > > On Thu, 22 Sep 2005, Randall Stewart wrote:
> > > 
> > > > Brian F. G. Bidulock wrote:
> > > > > Randall,
> > > > > 
> > > > > Good, that's settled.
> > > > > 
> > > > >
> > > > Now as to the HB issue.. I think we should do the following:
> > > > 
> > > > 1) As discussed have a hb.max.burst to seperate
> > > >     the initial hb's from the max.burst
> > > > 
> > > > 2) set this value at 2.
> > > > 
> > > > 
> > > > And yes, Brian I know you object to this.. but so far you
> > > are alone in
> > > > your objection...
> > > > 
> > > > Michael, I know you had wanted hb.max.burst set to 4, 
> but I think 
> > > > setting it to 2 is safer.... (as a default of course)...
> > > > 
> > > > I would like this discussion to draw to a close... at least on 
> > > > this item.. unless we have others that want to comment here...
> > > 
> > > No, the problem is all the HB get sent anyway.
> > > 
> > > Also, I am not convinced that even the Max.Burst that we 
> have limits 
> > > anything, because it does not establish a time period to which it 
> > > applies and is therefore not rate limiting.  The current 
> description 
> > > says something like "go away and come back", but a very 
> fast machine 
> > > can do that in a blink anyway.
> > >  So what does it limit?
> > > 
> > > In attack 6, all the HB get sent, and the amplification remains, 
> > > regardless of the setting of Hb.Max.Burst.
> > > 
> > > --brian
> > > 
> > > 
> > > > 
> > > > R
> > > > 
> > > > 
> > > > 
> > > > 
> > > > --
> > > > Randall Stewart
> > > > 803-345-0369 <or> 815-342-5222(cell)
> > > 
> > > -- 
> > > Brian F. G. Bidulock    ¦ The reasonable man adapts 
> himself to the ¦
> > > [email-masked]    ¦ world; the unreasonable one 
> persists in  ¦
> > > http://www.openss7.org/ ¦ trying  to adapt the  world  to 
> himself. ¦
> > >                         ¦ Therefore  all  progress  
> depends on the ¦
> > >                         ¦ unreasonable man. -- George 
> Bernard Shaw ¦
> > > 
> 
> -- 
> Brian F. G. Bidulock    ¦ The reasonable man adapts himself to the ¦
> [email-masked]    ¦ world; the unreasonable one persists in  ¦
> http://www.openss7.org/ ¦ trying  to adapt the  world  to himself. ¦
>                         ¦ Therefore  all  progress  depends on the ¦
>                         ¦ unreasonable man. -- George Bernard Shaw ¦
> 

_______________________________________________
tsvwg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tsvwg

---

From: Randall Stewart <[email-masked]>
Date: Fri, 23 Sep 2005 05:47:21 -0400

Schruefer, Wolfgang wrote:
> Brian,
> 
> as a client I would send immeadately n Heartbeats, where n is the
> number of my local adresses. Then the server could verify all paths
> immediately. I think that would work better than some other solution

I agree with Brian somewhat for his objection on this.. but I will
add one more.

The above is highly dependant on routing table's. It is
always possible that I can send to both of your addresses
and you can send to both of mine...

But I may NOT be able to send to your addresses with
the source addresses I wish to use depending on the
routes..

Consider
End-A                            End-Z
IP-A                              IP-X
IP-B                              IP-Y

End-A has a default route pointing out IP-A1 (its ISP).

If a packet sourced from IP-B goes out IP-A1, the ISP
does ingress filtering and drops it.

Its a linux box.. so it has a second route (default)
out IP-B-1.

This second route will only kick in when IP-A's network
fails..

So, now If End-A is the client, how can it do what you
say?

End-Z on the other hand can always reach IP-A and IP-B with
a HB.. .even thoug the HB it sends to IP-B comes back sourced
from IP-A... this is why we put the HB destination inside
the HB message (or at least most of us do :-D)

R