Subject: Re: comments on protocol draft

From: "Khosravi, Hormuzd M" <[email-masked]>
Date: Fri, 16 Jul 2004 17:28:14 -0700

Furquan,

Yes, we have done a study using different transport connections as well
as using prioritization in addition to different transports. A brief
summary of the results is as follows...

1. Using separate congestion/flow aware transport protocol connections
for data and control helps significantly in case of DoS attacks (we used
TCP for both)
2. Using prioritization of control messages over data messages, further
helps improve control connection performance during a DoS attack
So we would propose using a combination of the two to provide robustness
during a DoS attack.

Side Note- Using a combination of congestion aware and unaware
transports such as TCP and UDP for Control and Data doesn't work very
well, even with prioritization, cause the TCP traffic is easily
overwhelmed with UDP during an attack. (This is similar to the results
shown by Weiming during the last IETF meeting.)

Thanks
Hormuzd 

-----Original Message-----
From: Forwarding and Control Element Separation
[mailto:[email-masked]] On Behalf Of Furquan Ansari
Sent: Friday, July 16, 2004 8:07 AM
To: [email-masked]
Subject: Re: [FORCES] comments on protocol draft

Hormuzd,
    Thanks for the reply. It certainly would be great if you can share
your experimentation results with
the WG. I hope you would be doing a comparison study of the two methods
as well.

Thanks,

Khosravi, Hormuzd M wrote:

>Furquan,
>
>Thanks for your comments. I think these are all very good points and we
>will definitely work to address them in the future revs of the draft.
>Pls see a few comments below...
>
>-----Original Message-----
>From: Forwarding and Control Element Separation
>[mailto:[email-masked]] On Behalf Of Furquan Ansari
>
>4) ForCES data and control packet paths:
>   - From the text in the draft, it certainly looks like the same
>     association/channel is used for carrying both the control and the
>data
>     packets. I believe that this shouldn't be the case. The control
>     packets and the data packets should use two independent  channels
>     (associations) for sending and receiving messages between  the CE
>and
>     the FE. Any effect on one channel should not effect the other.
>
>[HK] I completely agree on this. This has been a design principle that
>we have pushed for and has been well received by the WG. #1 in section
4
>(TML Reqs) talks about Reliability by referencing RFC 3654 in which the
>reliability requirements for Data and Control messages are clearly
>differentiated as you have stated below.
>
>     a) The control channel setup between the CE and the FE may (will)
>have
>     totally different requirements from the data channel. E.g. we may
>     choose to use TCP as the TML layer to tranfer data from the FE to
>CE
>     (and vice-versa). However, the data channel may not require TCP,
or
>     in fact, should not use TCP. The data delivery reliability of the
>     forces data packets (e.g. routing packets) is independently taken
>     care of by the routing protocols themselves. The effect on some
>protocols
>     of reliably delivering data, but that is not timely may be
>disastrous -
>     i.e. the effects are unknown.
>
>     b) Irrespective of packet priority, if TCP is employed between the
>     CE/FE then packets will be delivered in order. The data packets
can
>     overwhelm the control packets and can lead to DoS. Not being able
>to
>     deliver the data (routing) packets should not prevent the forces
>control packets from reaching CE/FE.
>
>     The bottom line is, one should be able to independently choose the
>     transport mechanism (TML) between the CE and FE for the forces
>control
>     and data packets.
>
>[HK] We have done more analysis, experimentation in our Labs on
>separation of Data and Control (in the ForCES protocol) using separate
>Transport connections and have found that using Transport protocols
with
>congestion/flow control for both data and control and help
significantly
>during a DoS attacks. We have conducted experiments using TCP for both
>data and control as well as a combination of TCP and UDP for control,
>data respectively.
>
>Either myself or a colleague will be presenting our experimentation
>results at the IETF meeting in San Diego. I will make sure to share
this
>more widely with the WG.
>Thanks
>Hormuzd

---

From: "Joel M. Halpern" <[email-masked]>
Date: Fri, 16 Jul 2004 20:42:35 -0400

If we pretend for the moment that it is advanced enough to be applicable,
do your results tell us anything about what happens if we use TCP for
Control and DCCP for data packets between the FE and the CE?

Thank you,
Joel