Subject: [Capwap] UDP-Lite as optional transport for CAPWAP

From: "David Melman" <[email-masked]>
Date: Tue, 13 Mar 2007 10:29:01 +0200

Hi.

In supporting CAPWAP-over-UDP-IPv6, I'm concerned about the cost &
performance overhead of supporting a full UDP checksum over the entire
UDP payload.

While UDP over IPv4 allows the UDP checksum to be set 0 indicating the
UDP checksum is not calculated, UDP over IPv6 requires the UDP header to
contain a checksum which covers the UDP pseudo header and the UDP
payload (per RFC 2460). Calculating the checksum over the full data
payload adds significant cost and performance overhead, both to the AC
switch (typically implemented in hardware) and the WTP (typically
implemented in software).

I propose to allow CAPWAP over UDP-Lite (RFC 3828) as an optional
transport to UDP, particularly for the CAPWAP data channel which would
be impacted the most by the requirement to calculate the UDP checksum
over the entire payload. 

The UDP-Lite header is identical to the UDP header, except for the UDP
Length field which is replaced with the Checksum Coverage field. The
Checksum Coverage field indicates the number of octets, counting from
the first octet of the UDP-Lite header, that are covered by the
checksum. To minimize the performance impact, the UDP Checksum Coverage
is set to the minimal value of 8, which limits the UDP checksum to cover
just the UDP pseudo-header, excluding the UDP payload.  (Note that the
UDP Length field is not required, as it can easily be calculated by
subtracting 8 (UDP-Lite header length) from the IP Length field.)

UDP-Lite (RFC2460) is widely available in IPv6 stacks and in all the
common operating systems we surveyed.

I believe this change would have minimal impact to the CAPWAP protocol
and has significant value to both hardware and software implementations.

Regards,
David
 
__________________________________________

David Melman 
Architecture group - Marvell 
Email - [email-masked]

_________________________________________________________________
To unsubscribe or modify your subscription options, please visit:
http://lists.frascone.com/mailman/listinfo/capwap

Archives: http://lists.frascone.com/pipermail/capwap

---

From: "Pat Calhoun (pacalhou)" <[email-masked]>
Date: Tue, 13 Mar 2007 07:39:53 -0700

I completely agree with this request, and believe that if we want CAPWAP
to work over v6, the change is needed in this version of the protocol,
as requiring the UDP checksum be computed on each IPv6/UDP CAPWAP packet
would have a dramatic performance impact. I do not believe the feature
should be optional for v4 networks.

I have created issue 249. It is currently marked as a wish, but as per
my above statement, I believe we should categorize it as a bug.

Pat Calhoun
CTO, Wireless Networking Business Unit
Cisco Systems

> -----Original Message-----
> From: David Melman [mailto:[email-masked]] 
> Sent: Tuesday, March 13, 2007 1:29 AM
> To: [email-masked]
> Subject: [Capwap] UDP-Lite as optional transport for CAPWAP
> 
> Hi.
> 
> In supporting CAPWAP-over-UDP-IPv6, I'm concerned about the 
> cost & performance overhead of supporting a full UDP checksum 
> over the entire UDP payload.
> 
> While UDP over IPv4 allows the UDP checksum to be set 0 
> indicating the UDP checksum is not calculated, UDP over IPv6 
> requires the UDP header to contain a checksum which covers 
> the UDP pseudo header and the UDP payload (per RFC 2460). 
> Calculating the checksum over the full data payload adds 
> significant cost and performance overhead, both to the AC 
> switch (typically implemented in hardware) and the WTP 
> (typically implemented in software).
> 
> I propose to allow CAPWAP over UDP-Lite (RFC 3828) as an 
> optional transport to UDP, particularly for the CAPWAP data 
> channel which would be impacted the most by the requirement 
> to calculate the UDP checksum over the entire payload. 
> 
> The UDP-Lite header is identical to the UDP header, except 
> for the UDP Length field which is replaced with the Checksum 
> Coverage field. The Checksum Coverage field indicates the 
> number of octets, counting from the first octet of the 
> UDP-Lite header, that are covered by the checksum. To 
> minimize the performance impact, the UDP Checksum Coverage is 
> set to the minimal value of 8, which limits the UDP checksum 
> to cover just the UDP pseudo-header, excluding the UDP 
> payload.  (Note that the UDP Length field is not required, as 
> it can easily be calculated by subtracting 8 (UDP-Lite header 
> length) from the IP Length field.)
> 
> UDP-Lite (RFC2460) is widely available in IPv6 stacks and in 
> all the common operating systems we surveyed.
> 
> I believe this change would have minimal impact to the CAPWAP 
> protocol and has significant value to both hardware and 
> software implementations.
> 
> Regards,
> David
>

---

From: Margaret Wasserman <[email-masked]>
Date: Tue, 13 Mar 2007 13:42:08 -0400

I have no objection to adding a UDP-Lite option to CAPWAP, and I  
think David has done a great job of pointing out why it would be  
desirable.

Margaret

---

From: "Pat Calhoun (pacalhou)" <[email-masked]>
Date: Tue, 13 Mar 2007 12:59:07 -0700

Let me try again. UDP-Lite should be mandatory when run over IPv6. UDP
should continue to be mandatory when run over IPv4.

Pat Calhoun

> From: Pat Calhoun (pacalhou) 
> Sent: Tuesday, March 13, 2007 7:40 AM
> To: David Melman; [email-masked]
> Subject: Re: [Capwap] UDP-Lite as optional transport for CAPWAP
> 
> I completely agree with this request, and believe that if we 
> want CAPWAP to work over v6, the change is needed in this 
> version of the protocol, as requiring the UDP checksum be 
> computed on each IPv6/UDP CAPWAP packet would have a dramatic 
> performance impact. I do not believe the feature should be 
> optional for v4 networks.
> 
> I have created issue 249. It is currently marked as a wish, 
> but as per my above statement, I believe we should categorize 
> it as a bug.
> 
> Pat Calhoun
> indicating the 
> > UDP checksum is not calculated, UDP over IPv6 requires the 
> UDP header 
> > to contain a checksum which covers the UDP pseudo header 
> and the UDP 
> > payload (per RFC 2460).
> significant 
> > cost and performance overhead, both to the AC switch (typically 
> > implemented in hardware) and the WTP (typically implemented in 
> > software).
> > 
> for the UDP 
> > checksum. To minimize the performance impact, the UDP Checksum 
> > Coverage is set to the minimal value of 8, which limits the UDP 
> > checksum to cover just the UDP pseudo-header, excluding the UDP 
> > payload.  (Note that the UDP Length field is not required, 
> as it can 
> > easily be calculated by subtracting 8 (UDP-Lite header

---

From: "David Melman" <[email-masked]>
Date: Tue, 13 Mar 2007 22:04:01 +0200

This is quite acceptable to me as well.

David 

-----Original Message-----
From: Pat Calhoun (pacalhou) [mailto:[email-masked]] 
Sent: Tuesday, March 13, 2007 9:59 PM
To: Pat Calhoun (pacalhou); David Melman; [email-masked]
Subject: RE: [Capwap] UDP-Lite as optional transport for CAPWAP

Pat Calhoun

> I completely agree with this request, and believe that if we want 
> CAPWAP to work over v6, the change is needed in this version of the 
> protocol, as requiring the UDP checksum be computed on each IPv6/UDP 
> CAPWAP packet would have a dramatic performance impact. I do not 
> believe the feature should be optional for v4 networks.
> 

> CTO, Wireless Networking Business Unit Cisco Systems
> 
>  
>

---

From: "Puneet Agarwal" <[email-masked]>
Date: Wed, 14 Mar 2007 14:45:03 -0700

Hi Pat,

One of the goals of capwap was to go easily through firewalls/nats. Is
UDP-lite supported by the existing nat/firewalls (since the nat will
have to play around with the checksum which includes the ip psuedo-hdr)?

Thanks.

-Puneet

-----Original Message-----
From: Pat Calhoun (pacalhou) [mailto:[email-masked]] 
Sent: Tuesday, March 13, 2007 12:59 PM
To: Pat Calhoun (pacalhou); David Melman; [email-masked]
Subject: Re: [Capwap] UDP-Lite as optional transport for CAPWAP

Pat Calhoun

---

From: "Pat Calhoun (pacalhou)" <[email-masked]>
Date: Wed, 14 Mar 2007 15:02:09 -0700

That may be an issue for IPv6, but note that NATs are supposed to go
away with the new address space... I don't have lots of visibility into
this space though.

Pat Calhoun

> From: Puneet Agarwal [mailto:[email-masked]] 
> Sent: Wednesday, March 14, 2007 2:45 PM
> One of the goals of capwap was to go easily through 
> firewalls/nats. Is UDP-lite supported by the existing 
> nat/firewalls (since the nat will have to play around with 
> the checksum which includes the ip psuedo-hdr)?
> 
> Thanks.
> 
> -Puneet
> 
> Let me try again. UDP-Lite should be mandatory when run over 
> IPv6. UDP should continue to be mandatory when run over IPv4.
> 
> Pat Calhoun
> but as per

---

From: "Sudhanshu" <[email-masked]>
Date: Thu, 15 Mar 2007 18:36:23 -0700

I don't think we need to care for the NAT transport as such. CAPWAP is an
application to UDP (and now UDP-lite) and we can leave it there. CAPWAP
provide the consideration (guidelines) on how to work over NAT, which is
different from NAT transport.

My 2cents. Also there is no reason for us to specify UDP is mandatory for
IPv4 and UDP-lite for IPv6. Although, it would be the most likely case.

UDP-lite no where mention that it is for IPv6 only. And if some deployments
don't want to trust the media/link, it should be OK to use UDP over IPv6.
CAPWAP does not need to limit itself.

_Suds

-----Original Message-----
From: Pat Calhoun (pacalhou) [mailto:[email-masked]] 
Sent: Wednesday, March 14, 2007 3:02 PM
To: Puneet Agarwal; David Melman; [email-masked]
Subject: Re: [Capwap] UDP-Lite as optional transport for CAPWAP

Pat Calhoun

---

From: "Pat Calhoun (pacalhou)" <[email-masked]>
Date: Fri, 16 Mar 2007 07:01:19 -0700

I disagree. If we were to use UDP-Lite over IPv4, then it is unclear
how a NAT system would behave. I do agree that there is a problem there.
I feel this is less of a problem for IPv6, because the intent of the 
expanded address space was to remove NATs. Whether this is true in the
real world or not is unknown.

If we are not prescriptive about what is mandatory, then we end up
with interoperability problems. So I would once again submit that 
we should consider UDP as mandatory for IPv4 (as it is in the current
spec), and UDP-Lite as mandatory for IPv6 (new text required).

Pat Calhoun

> From: Sudhanshu [mailto:[email-masked]] 
> Sent: Thursday, March 15, 2007 6:36 PM
> To: Pat Calhoun (pacalhou); 'Puneet Agarwal'; 'David Melman'; 
> [email-masked]
> I don't think we need to care for the NAT transport as such. 
> CAPWAP is an application to UDP (and now UDP-lite) and we can 
> leave it there. CAPWAP provide the consideration (guidelines) 
> on how to work over NAT, which is different from NAT transport.
> 
> UDP-lite no where mention that it is for IPv6 only. And if 
> some deployments don't want to trust the media/link, it 
> should be OK to use UDP over IPv6.
> That may be an issue for IPv6, but note that NATs are 
> supposed to go away with the new address space... I don't 
> have lots of visibility into this space though.
> 
> Pat Calhoun
> firewalls/nats. Is

---

From: "Sudhanshu" <[email-masked]>
Date: Fri, 16 Mar 2007 16:03:29 -0700

Please see my inline comments below.

-----Original Message-----
From: Pat Calhoun (pacalhou) [mailto:[email-masked]] 
Sent: Friday, March 16, 2007 7:01 AM
To: Sudhanshu; Puneet Agarwal; David Melman; [email-masked]
Subject: RE: [Capwap] UDP-Lite as optional transport for CAPWAP

I disagree. If we were to use UDP-Lite over IPv4, then it is unclear
how a NAT system would behave. 
[Suds] UDP-Lite over NAT (IPv4 or V6) has nothing to do with CAPWAP
specification. And it is outside the scope of this (CAPWAP) discussion.

I do agree that there is a problem there.
I feel this is less of a problem for IPv6, because the intent of the 
expanded address space was to remove NATs. Whether this is true in the
real world or not is unknown.

[Suds] Don't forget transition from IPv6 to IPv4 and vice-versa and
dual-stack host. We can complicate it as much as we want.

[Suds]IMO, for the sake of interoperability we should not limit to one or
the other option as long as protocol can spit out proper error/debugging
messages. And UDP in case of IPv6 should def. be an option as it has some
advantages. UDP-lite does not provide enough protection. 

Also from RFC (atleast), the intent for UDP-lite is not the performance
instead some of the application which can take the packet with partial
corruption. And def. CAPWAP will not be able to take the packet with partial
corruption. Please correct me if I am wrong.

_Suds

---

From: "David Melman" <[email-masked]>
Date: Sun, 18 Mar 2007 10:08:29 +0200

In regards to the comment by Suds that "in case of IPv6 UDP-Lite does
not provide enough protection", note that if the UDP-Lite Checksum
Coverage field is set to zero, the entire UDP-Lite packet  is covered by
the checksum, I.e. this is the same coverage as UDP.  This is the
recommended default behavior of UDP-Lite.

David

-----Original Message-----
From: Sudhanshu [mailto:[email-masked]] 
Sent: Saturday, March 17, 2007 1:03 AM
To: 'Pat Calhoun (pacalhou)'; 'Puneet Agarwal'; David Melman;
[email-masked]

-----Original Message-----
From: Pat Calhoun (pacalhou) [mailto:[email-masked]]
Sent: Friday, March 16, 2007 7:01 AM
To: Sudhanshu; Puneet Agarwal; David Melman; [email-masked]
Subject: RE: [Capwap] UDP-Lite as optional transport for CAPWAP

I disagree. If we were to use UDP-Lite over IPv4, then it is unclear how
a NAT system would behave. 
[Suds] UDP-Lite over NAT (IPv4 or V6) has nothing to do with CAPWAP
specification. And it is outside the scope of this (CAPWAP) discussion.

If we are not prescriptive about what is mandatory, then we end up with
interoperability problems. So I would once again submit that we should
consider UDP as mandatory for IPv4 (as it is in the current spec), and
UDP-Lite as mandatory for IPv6 (new text required).

[Suds]IMO, for the sake of interoperability we should not limit to one
or the other option as long as protocol can spit out proper
error/debugging messages. And UDP in case of IPv6 should def. be an
option as it has some advantages. UDP-lite does not provide enough
protection. 

Also from RFC (atleast), the intent for UDP-lite is not the performance
instead some of the application which can take the packet with partial
corruption. And def. CAPWAP will not be able to take the packet with
partial corruption. Please correct me if I am wrong.

_Suds
> CAPWAP is an application to UDP (and now UDP-lite) and we can leave it

> there. CAPWAP provide the consideration (guidelines) on how to work 
> over NAT, which is different from NAT transport.
> 
> UDP-lite no where mention that it is for IPv6 only. And if some 
> deployments don't want to trust the media/link, it should be OK to use

> UDP over IPv6.
> away with the new address space... I don't have lots of visibility 
> into this space though.
> 
> Pat Calhoun

---

From: "Pat Calhoun (pacalhou)" <[email-masked]>
Date: Mon, 19 Mar 2007 00:08:32 -0700

The issue, Suds, is that I had not realized until this post that UDP
over IPv6 
cannot have a NULL checksum. In IPv4 networks, most CAPWAP
implementations will
set the checksum to NULL because of the cost of generating this field at

line rate. We simply cannot rely on a solution that now requires that
vendors
start setting this field just because they are running IPv6.

Pat Calhoun

> Sent: Friday, March 16, 2007 4:03 PM
> I disagree. If we were to use UDP-Lite over IPv4, then it is 
> unclear how a NAT system would behave. 
> [Suds] UDP-Lite over NAT (IPv4 or V6) has nothing to do with 
> CAPWAP specification. And it is outside the scope of this 
> (CAPWAP) discussion.
> 
> I feel this is less of a problem for IPv6, because the intent 
> of the expanded address space was to remove NATs. Whether 
> this is true in the real world or not is unknown.
> 
> [Suds] Don't forget transition from IPv6 to IPv4 and 
> vice-versa and dual-stack host. We can complicate it as much 
> as we want.
> 
> If we are not prescriptive about what is mandatory, then we 
> end up with interoperability problems. So I would once again 
> submit that we should consider UDP as mandatory for IPv4 (as 
> it is in the current spec), and UDP-Lite as mandatory for 
> IPv6 (new text required).
> 
> [Suds]IMO, for the sake of interoperability we should not 
> limit to one or the other option as long as protocol can spit 
> out proper error/debugging messages. And UDP in case of IPv6 
> should def. be an option as it has some advantages. UDP-lite 
> does not provide enough protection. 
> 
> Also from RFC (atleast), the intent for UDP-lite is not the 
> performance instead some of the application which can take 
> the packet with partial corruption. And def. CAPWAP will not 
> be able to take the packet with partial corruption. Please 
> correct me if I am wrong.
> 
> _Suds
> > My 2cents. Also there is no reason for us to specify UDP is 
> mandatory 
> > for
> supposed to go

---

From: "Pat Calhoun (pacalhou)" <[email-masked]>
Date: Mon, 19 Mar 2007 02:26:31 -0700

I just sent proposed text, and recommended the checksum coverage to be
eight (8), not zero (0).

Pat Calhoun

> Sent: Sunday, March 18, 2007 1:08 AM
> To: [email-masked]
> In regards to the comment by Suds that "in case of IPv6 
> UDP-Lite does not provide enough protection", note that if 
> the UDP-Lite Checksum Coverage field is set to zero, the 
> entire UDP-Lite packet  is covered by the checksum, I.e. this 
> is the same coverage as UDP.  This is the recommended default 
> behavior of UDP-Lite.
> 
> David
>

---

From: "David Melman" <[email-masked]>
Date: Mon, 19 Mar 2007 12:06:19 +0200

Thanks Pat - this indeed was my intent to recommend the UDP-Lite
checksum coverage to be set to (8).  

David 

-----Original Message-----
From: Pat Calhoun (pacalhou) [mailto:[email-masked]] 
Sent: Monday, March 19, 2007 11:27 AM
To: David Melman; [email-masked]
Subject: RE: [Capwap] UDP-Lite as optional transport for CAPWAP

Pat Calhoun

> Coverage field is set to zero, the entire UDP-Lite packet  is covered 
> by the checksum, I.e. this is the same coverage as UDP.  This is the 

> with interoperability problems. So I would once again submit that we 
> should consider UDP as mandatory for IPv4 (as it is in the current 

> performance instead some of the application which can take the packet 
> with partial corruption. And def. CAPWAP will not be able to take the 
> packet with partial corruption. Please correct me if I am wrong.
> 
> _Suds

---

From: "Sudhanshu" <[email-masked]>
Date: Mon, 19 Mar 2007 11:35:40 -0700

Any IPv6 host will most likely will run the UDP. Now we are mandating that
it should also run the UDP-lite, which is an extra burden for it.  

As far as compatibility is concerned, it is already taken care using
ICMP/ICMPv6 error message.

So I think I am missing the real need to make UDP-lite mandatory here.

_Suds

-----Original Message-----
From: Pat Calhoun (pacalhou) [mailto:[email-masked]] 
Sent: Monday, March 19, 2007 12:09 AM
To: Sudhanshu; Puneet Agarwal; David Melman; [email-masked]
Subject: RE: [Capwap] UDP-Lite as optional transport for CAPWAP

Pat Calhoun