Subject: RE: [Ietf-behave] FW: I-D ACTION:draft-ietf-behave-nat-udp-02.txt

From: "Senthil Sivakumar (ssenthil)" <[email-masked]>
Date: Mon, 4 Jul 2005 16:07:02 -0700 (PDT)

> -----Original Message-----
> From: ietf-behave-bounces@xxxxxxxxxxxxxxxxxxx 
> [mailto:ietf-behave-bounces@xxxxxxxxxxxxxxxxxxx] On Behalf Of 
> Paul Hoffman
> Sent: Monday, July 04, 2005 6:03 PM
> To: Behave
> Subject: RE: [Ietf-behave] FW: I-D 
> ACTION:draft-ietf-behave-nat-udp-02.txt
> 
> At 8:06 AM -0700 7/4/05, Senthil Sivakumar (ssenthil) wrote:
> >Timeouts are definitely needed otherwise you would be consuming the 
> >resources of the box.
> 
> Fully disagree. Timeouts are completely unnecessary on a 
> system that watches its resources and, when a resource gets 
> close to full, starts to discard based on a sensible 
> algorithm (which could be "oldest" in almost all cases).
> 

Disagree as well. Using the resources for longer than necessary is not
good engineering either. In this case we are talking about ICMP mappings
and you are going to let the ICMP mappings stay and consume the
resources of the box until the box runs "close to full"? We have defined
timeouts through out the behave drafts - basically those are all
unnecessary?
Can you point me to a NAT implementation that does it the way you have
mentioned? 

> Trying to guess what a good/reasonable time for a timer 
> without a lot of research is not engineering.

That is the reason for question of 2 seconds.
> 
> --Paul Hoffman, Director
> --Cybersecurity Association
> --www.cybersecurity.org
> _______________________________________________
> Ietf-behave mailing list
> Ietf-behave@xxxxxxxxxxxxxxxxxxx
> https://list.sipfoundry.org/mailman/listinfo/ietf-behave
>

---

From: Paul Hoffman <[email-masked]>
Date: Mon, 4 Jul 2005 16:33:21 -0700 (PDT)

At 4:07 PM -0700 7/4/05, Senthil Sivakumar (ssenthil) wrote:
Disagree as well. Using the resources for longer than necessary is not
good engineering either.
We agree there. However, no one has defined "longer than necessary". 
Picking a length of time without any backing from either the RFCs or 
experimentation can't answer that.

In this case we are talking about ICMP mappings
and you are going to let the ICMP mappings stay and consume the
resources of the box until the box runs "close to full"?
No, that's now what I said. I explicitly said "when a resource gets 
close to full". You don't toss all the resources into one memory 
heap: different mappings have different buffers, and when you put 
something into a buffer, you check if that buffer is getting close to 
full. This is a completely common programming technique used by 
nearly every network device vendor.

We have defined
timeouts through out the behave drafts
I'm not sure who you mean by "we". See section 4 of 
draft-hoffman-behave-tcp-00.txt for a counter-example.

- basically those are all
unnecessary?
Correct, unless they match a timer in the RFC that defines the 
protocol in question, or they are taken from some research that 
people agree is complete and well-founded.

--Paul Hoffman, Director