Subject: [Int-area] Roman Danyliw's No Objection on draft-ietf-intarea-frag-fragile-15: (with COMMENT)

From: Roman Danyliw via Datatracker <[email-masked]>
Date: Wed, 07 Aug 2019 17:40:28 -0700

Roman Danyliw has entered the following ballot position for
draft-ietf-intarea-frag-fragile-15: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-intarea-frag-fragile/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

** I support Alissa Cooper's discuss item

** Section 3.7.  Per the discussion about NIDS, evasion using fragments also
arose when stateless pattern matching occurred.

** Section 3.7.  Related to NIDS, naïve flow-based anomaly detection
systems/analytics have also been known to introduce false positives, if IP
packet counts are confused with IP fragment counts.

** Editorial
-- Section 1.  Per “but the designer should to be aware that fragmented packets
may result in blackholes”, the reference to a “blackholes” seems imprecise.

-- Section 2.1.  Typo.  s/Whlie/While/

-- Section 3.8.2.  Recommend adding a sentence at the end of the first
paragraph to suggest this is just an example.  I’ve seen even worst default
ICMP policies in consumer routers.

-- Section 3.8.2.  Typo.  s/a incorrect/an incorrect/

-- Section 5.1. Typo. s/signalling/signaling/