Subject: Re: [Spud] ??????: Numbers...

From: Youjianjie <[email-masked]>
Date: Fri, 12 Jun 2015 07:38:38 -0700

I have never heard 99% of UDP is trash to be true. Security folks
in Cisco told me "a lot of unix networking apps from the 80th/90th
based on UDP where extremely insecure", and i think thats definitely
true and has lead the first wave of firewalling off UDP. The second
wave was p2p sharing apps which also caused a lot of enterprises to be
weary of UDP and firewall it. 

On Fri, Jun 12, 2015 at 09:48:55AM +0000, Youjianjie wrote:
> Hi,
> 
> I'm also confused about the following description:
> "Today UDP is often blocked (???99% of UDP is garbage???) but volume of (good) UDP traffic grows, e.g. RTCWEB uses UDP for data and media"
> 
> What kind of UDP is called garbage? Why UDP is often blocked?
> Could somebody please explain?
> 
> Thanks,
> Jianjie
> 
> > -----????????????-----
> > ?????????: Spud [mailto:[email-masked]] ?????? Mirja Kühlewind
> > ????????????: 2015???3???25??? 20:55
> > ?????????: Martin Stiemerling
> > ??????: [email-masked]
> > ??????: Re: [Spud] Numbers...
> > 
> > Hi Martin,
> > 
> > this sentence is in quotes because that???s stuff people did actually say to me or
> > others. 99% is not true but there are currently no number publicly available to
> > our knowledge. We just started measurements on this and we are also
> > currently talking to people who might have some numbers e.g. for
> > chrome/QUIC (that???s part of the hops activity).
> > 
> > Mirja
> > 
> > 
> > > Am 25.03.2015 um 07:31 schrieb Martin Stiemerling <[email-masked]>:
> > >
> > > Hi all,
> > >
> > > I am just going through the slides for today's BOF and just got stuck on slide 5
> > of which says:
> > > "Today UDP is often blocked (???99% of UDP is garbage???) but volume of
> > > (good) UDP traffic grows, e.g. RTCWEB uses UDP for data and media"
> > >
> > > Is there reliable data that underscores UDP is often blocked?
> > >
> > > I can see cases, e.g., enterprises where this is true, but in most other
> > settings my UDP traffic is just making it to the other end, by today. Was
> > different a couple of years ago, when there was no stateful filtering of UDP
> > traffic implemented.
> > >
> > > Thanks,
> > >
> > >  Martin
> > >
> > > _______________________________________________
> > > Spud mailing list
> > > [email-masked]
> > > https://www.ietf.org/mailman/listinfo/spud
> > 
> > _______________________________________________
> > Spud mailing list
> > [email-masked]
> > https://www.ietf.org/mailman/listinfo/spud
> _______________________________________________
> Spud mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/spud

-- 
---
Toerless Eckert, [email-masked]

---

From: Christian Huitema <[email-masked]>
Date: Fri, 12 Jun 2015 17:22:15 +0000

> I have never heard 99% of UDP is trash to be true. Security folks in Cisco told me
> "a lot of unix networking apps from the 80th/90th based on UDP where
> extremely insecure", and i think thats definitely true and has lead the first wave
> of firewalling off UDP. The second wave was p2p sharing apps which also
> caused a lot of enterprises to be weary of UDP and firewall it.

Two big applications that are running over UDP: voice and video with Skype, video-games with Xbox Live. Of course, there are places where UDP is blocked, in which case UDP applications will try tunneling over HTTPS. But in the vast majority of consumer networks, these applications use UDP just fine.

-- Christian Huitema

---

From: Tom Herbert <[email-masked]>
Date: Fri, 12 Jun 2015 16:37:33 -0700

> Two big applications that are running over UDP: voice and video with Skype, video-games with Xbox Live. Of course, there are places where UDP is blocked, in which case UDP applications will try tun…
Christian,

You present a very interesting datapoint, but I'm not sure how to
interpret it. Is UDP getting far reach now because most users are not
behind firewalls, firewalls are allowing all UDP to pass, or holes
have been commonly punched in firewalls for specific applications?
Would this imply there is less need to implement a UDP based protocol
to work with stateful firewalls?

Thanks,
Tom

---

From: Christian Huitema <[email-masked]>
Date: Fri, 12 Jun 2015 23:43:00 +0000

> to work with stateful firewalls?

Most end points are behind some kind of firewall or NAT. UDP works through that, largely because we have a long history of developing NAT traversal tools like STUN, TURN, or ICE.

-- Christian Huitema

---

From: Yoav Nir <[email-masked]>
Date: Sat, 13 Jun 2015 11:17:17 +0300

> On Jun 13, 2015, at 2:37 AM, Tom Herbert <[email-masked]> wrote:
> 

Most modern firewalls can recognize these different applications, so it is possible to configure a firewall to let Skype or WebRTC through without just allowing any and all UDP to pass.

But the usual configuration for firewalls is to block the unknown. So making something that is easy to recognize is definitely a good idea. 

Yoav

---

From: "Pal Martinsen (palmarti)" <[email-masked]>
Date: Tue, 16 Jun 2015 08:12:51 +0000

> On 13 Jun 2015, at 01:37, Tom Herbert <[email-masked]> wrote:
> 

Thanks Cristian for the datapoint. I think enterprise numbers are different (I am assuming that Skype and X-box are not typically enterprise applications). But it shows that most home equipment work with this approach, and nothing in the middle on the big dark ans scary Internet breaks UDP. That is very useful information.

So the remaining problem seems to be enterprise networks and the fears of opening up UDP. And hopefully something SPUD like can help with that.

.-.
Pål-Erik

---

From: Yoav Nir <[email-masked]>
Date: Tue, 16 Jun 2015 12:15:49 +0300

> On Jun 16, 2015, at 11:12 AM, Pal Martinsen (palmarti) <[email-masked]> wrote:
> 
>> 
> Thanks Cristian for the datapoint. I think enterprise numbers are different (I am assuming that Skype and X-box are not typically enterprise applications).

Skype (or equivalent) does get used in enterprises. X-box? Not as much...

> But it shows that most home equipment work with this approach, and nothing in the middle on the big dark ans scary Internet breaks UDP. That is very useful information.

“Nothing" is perhaps too strong. As long as the UDP packets are small enough, the big bad Internet will let it through, but there are places where fragments are dropped. Not usually a problem for VoIP, but could be for other applications.

> So the remaining problem seems to be enterprise networks and the fears of opening up UDP. And hopefully something SPUD like can help with that.

Hopefully. But there’s also the coffee shop / hotel / public transit networks that tend to have some very badly configured firewalls with heavy-handed filtering. 

Yoav
(who works for a firewall vendor)