Subject: [Ietf-behave] Feedback on the meeting minutes

From: Fernando Gont <[email-masked]>
Date: Fri, 9 Dec 2005 04:37:11 -0800 (PST)

Hi,

Some feedback on the meeting minutes

NAT Behavioral Requirements for Unicast TCP
===========================================
Discussion:
Security considerations say do not send RST to SYN, but send ICMP
soft-error, in order to prevent identity theft.  TCP WG is working on
this problem.  Should be different error.  Also, sending error can make
life difficult for end system.
One issue I raised at the meeting and that is not reflected in the minutes 
is that the authors seem to assume that an ICMP soft-error will prevent 
identity theft, when it won't. As per RFC 1122, TCP will not abort 
connections upon receipt of an ICMP soft error.

However, an internet-draft on TCP's reaction to soft errors that has become 
a WG item of the TCPM WG describes an alternative behaviour implemented in 
many TCP implementations, which makes TCP abort a connection when it is in 
any of the non-synchronized states. (see http://www.gont.com.ar , TCP's 
reaction to soft errors).

Even then, note that if anything, sending an ICMP soft error (in case the 
above behaviour is implemented) will elict the same reaction from TCP than 
a TCP RST. So, if anything, use TCP resets, instead of ICMP messages.

Kindest regards,

--
Fernando Gont
e-mail: fernando@xxxxxxxxxxx || fgont@xxxxxxx