Subject: [Ietf-behave] few random notes from

From: Cullen Jennings <[email-masked]>
Date: Mon, 7 Mar 2005 18:03:42 -0800 (PST)

Below is some raw unprocessed notes I took - may be right or wrong. I will
merge with official notes later.

Need to sync up with Fernando Gont and Mark Allman and others about ICMP
processing with respect to TCP in NATs. draft-gont-tcpm-icmp-attacks

Discussion on topic of security - The topic of randomized IP addressed.
Requirements here are not for all NATs in the world.

Need to carefully check all our SHOULD and explain when can/can not do them.

On UDP ALG - recommend that default setting is ON for DNS and FTP and off
for all others. 

Long discussion - of symmetric definition in STUN RFC.

No objections to moving multicast to WG item

More things for testing:
Router Alter options
MTU handling 
Deterministic behavior - more than one
Hairpin work / external or internal address used

Comment that NATs should not send messages to try and keep the session alive
by testing liveness of the applications on either end.

TCP timers - need to say we need to mindful when we pick these values

Other behaviors - based on service type or destination of address - can
enforce different types of rules. Greg work with Nagendra to bring up a few
cases about this on the list.

Question - about source port. Do any protocol need source port stay the
same. Some suggestions IKE implementations are broke and follow this - need
to get examples of version that do.

RST stuff - want to provide hint to NAT implementers - if we drop
immediately then we might break stuff. Don't want NAT do RST unless track
SEQ numbers. RST , set timer to low value. This is a Firewall.

Seq# readjustment - need to deal with this for ALG such DNS/FTP.

Need discussion around what do do with out of order fragment.