Subject: Re: [savi] SAVI Bindings For Hosts Behind Legacy Switches?

From: ZhangDong <[email-masked]>
Date: Mon, 01 Jun 2009 16:42:08 +0800

>  FCFS.  All it requires is adding an option to disable SAVI protection
>  for certain ports.  Such an option would be useful anyhow, as Marcelo
>  stated earlier.  And I would encourage Marcelo to add this feature to
>  the FCFS specification.

IMHO, though protection of certain ports which are connected with legacy switchs is disabled, the binding should be established still.
I mean for the certain ports the bindings are also created according to FCFS. What is really disabled is the action of dropping the following packets that are not coincident with the bindings in SAVI device, while not the action of creating bindings. 
I suppose that the bindings created from the certain ports should be added a special mark in the binding table of SAVI device. When the SAVI device receives packets that are not coincident with the bindings created from the certain ports, it lets the packets pass. At the same time, the SAVI device should send a warning or write a warning in the log. It will be very helpful to analyze and track who is spoofing or what the real problem of IP 
duplication is.

So my point is the SAVI device should not only disabling protection of certain ports, but also need to record the occurrence of IP duplication after the bindings created from the certain ports.

Thank you.

Dong Zhang

---

From: "Guang Yao" <[email-masked]>
Date: Mon, 1 Jun 2009 22:49:53 +0800

I agree. This is similar with what I mentioned: "Use local bindings to deny
packets from indirect connected host.".

> -----Original Message-----
> From: ZhangDong [mailto:[email-masked]]
> Sent: Monday, June 01, 2009 4:42 PM
> To: Christian Vogt
> Cc: Marcelo Bagnulo Braun; Guang Yao; SAVI Mailing List
> Subject: Re: Re: [savi] SAVI Bindings For Hosts Behind Legacy Switches?
> 
> 
> IMHO, though protection of certain ports which are connected with legacy
> switchs is disabled, the binding should be established still.
> I mean for the certain ports the bindings are also created according to
FCFS.
> What is really disabled is the action of dropping the following packets
that
> are not coincident with the bindings in SAVI device, while not the action
of
> creating bindings.
> I suppose that the bindings created from the certain ports should be added
a
> special mark in the binding table of SAVI device. When the SAVI device
> receives packets that are not coincident with the bindings created from
the
> certain ports, it lets the packets pass. At the same time, the SAVI device
> should send a warning or write a warning in the log. It will be very
helpful to
> analyze and track who is spoofing or what the real problem of IP
> duplication is.
> 
> So my point is the SAVI device should not only disabling protection of
certain
> ports, but also need to record the occurrence of IP duplication after the
> bindings created from the certain ports.
> 
> 
> Thank you.
> 
> Dong Zhang
> 
>