Subject: RE: Thoughts on address selection

From: "Dan Wing" <[email-masked]>
Date: Tue, 1 Dec 2009 22:19:10 -0800

(catching up on an old thread.) 

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On 
> Behalf Of Stig Venaas
> Sent: Wednesday, November 18, 2009 10:44 AM
> To: Fred Baker
> Cc: [email-masked]; IETF IPv6 
> Mailing List; 
> [email-masked]; 
> Mohacsi Janos; [email-masked]
> Subject: Re: Thoughts on address selection
> 
> Fred Baker wrote:
> > 
> > On Nov 18, 2009, at 6:22 PM, Arifumi Matsumoto wrote:
> > 
> >> I guess that is because if you force to try all the pairs, 
> it perfectly
> >> ignores the address selection manner defined in RFC 3484, and thus,
> >> it gives us not little impact.
> > 
> > If they space them closely and run them in parallel, I 
> guess I don't see 
> > the impact. Imagine you have five addresses and your peer has five 
> > addresses, so there are 25 pairs. Imagine you are spacing 
> the SYNs 10 ms 
> > apart. Imagine that the only pair that works is the last 
> one you try. 
> 
> I'm a bit worried about this. If e.g. the host is 100ms (RTT) away and
> 10 combinations work, you may end up creating TCP state (and getting
> syn-acks back) on the destination host for 10 connections, 

Are there servers that don't use SYN-cookies now-a-days?

> while you are
> only going to use one.
> 
> I feel the delay between then should ideally be a bit longer than the
> RTT. Which is fine if you only try a few combinations. Of course one
> problem is that you don't really know what the RTT will be.

If I knew the RTT...

-d

> Stig
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> [email-masked]
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------

---

From: Rémi Denis-Courmont <[email-masked]>
Date: Wed, 02 Dec 2009 11:17:48 +0100

> Are there servers that don't use SYN-cookies now-a-days?

IIRC, recent Linux kernel version have SYN-cookies disabled by default as
they were found to make things often worse rather than better.

-- 
Rémi Denis-Courmont

---

From: Scott Brim <[email-masked]>
Date: Wed, 02 Dec 2009 09:42:28 -0500

> they were found to make things often worse rather than better.

I'd like to know why.  Unicast if you like.

---

From: "Dan Wing" <[email-masked]>
Date: Wed, 2 Dec 2009 09:32:32 -0800

> From: Rémi Denis-Courmont [mailto:[email-masked]] 
> Sent: Wednesday, December 02, 2009 2:18 AM
> To: Dan Wing
> Cc: Stig Venaas; Fred Baker; 
> [email-masked]; 
> IETF IPv6 Mailing List; Mohacsi Janos; 
> [email-masked]
> Subject: RE: Thoughts on address selection
> 
> 
> IIRC, recent Linux kernel version have SYN-cookies disabled 
> by default as they were found to make things often worse 
> rather than better.

I found this citation regarding SYN cookies, which seems to
indicate further evolution of both minisock and SYN cookies
(to support WINSCALE and SACK) in Linux, 
http://lwn.net/Articles/277146/

-d