Subject: Re: MBone

From: "Kevin C. Almeroth" <[email-masked]>
Date: Thu, 12 Sep 2002 05:21:49 -0700 (PDT)

>>>The content
>>>sent from the IETF can be received with Real, Media Player, Quicktime,
>>>IPTV, vic/vat, etc.
>>>
>>Most of those are not multicast--and they certainly aren't conferencing.

Every single one is absolutely multicast-capable.  Even better is that
there are codecs that can generate a stream that all the players can
receive.  In other words, interoperability works well if you use the
right format.

>>>Also, there are plenty of (surviving) companies offering non-conferencing
>>>
>>I was talking about conferencing.

See above, though you can certainly question their state of "survival".  ;-)
Also see vbrick.com.  Heck, even polycom has a multicast solution.  Really,
there are plenty of companies that have multicast-based conferencing solutions
as part of their product lines.

What it seems like you miss from not doing some homework is that multicast is
a working solution with working tools.  Granted, it isn't widely deployed.
Granted, inter-domain deployment may not be widespread at all.  But you seem
to miss that there is significant use of multicast...  even more so inside
of corporate networks (something we can't see from general monitoring).

>>>>>but consider: once you start running a 
>>>>>multicast session over the Internet, anybody who's within the TTL range 
>>>>>can intercept it.
>>>>>
>>>Same with UDP traffic.  Same with TCP traffic.  
>>>
>>No, those can be intercepted only by tricking the routers.  Multicast 
>>specifically permits anyone to pick up the traffic just by asking for it.

First point:  not necessarily.

Second point:  as long as you know the group address.  with large volumes of
multicast traffic out there you also have a nice 28 bit key, i.e. it is
now infeasible for a host to join every group and expect not to be overwhelmed
with large amounts of traffic.

Finally, bottom line is if the content is valuable you at least need some
basic protection...  something like the equivalent of the club.  To use
content-value or privacy or anything else along these lines as a reason
for not using multicast is pretty weak.

-Kevin

---

From: Joe Touch <[email-masked]>
Date: Thu, 12 Sep 2002 09:46:44 -0700

> First point:  not necessarily.

It only requires being on a non-IGMP'd switch or a hub; at that point,
you can snoop the traffic and see any packet going to any multicast group.

It's much harder to snoop UDP; for non-broadcast, you'd have to be
in-line (on the wire, effectively) or on a hub. While hubs are becoming
less common, they're often being replaced with cheaper non-IGMP-capable
switches. Which means that they're still hubs, as far as multicast
traffic is concerned.

> with large amounts of traffic.

If no other host/router on your LAN is attached to the group, OR if the
switch you're on is IGMP-capable, then yes, you have a 28-bit key.

Alternately, if you're on a non-IGMP'd switch or a hub, and someone else
on the LAN is a member of the group, then you don't have a 28-bit key.
You can snoop and see the list of addresses in use, a much smaller set.

Finally, there are rules that hint at how to use subsets of addresses
for different uses (notably different scopes), e.g., RFC2365, a BCP.
That makes finding the 'needle in the haystack' much easier, e.g., if
you're hunting for teleconferencing, unless overrides are used, the
space is 15 bits, not 28.

Joe