Subject: Re: AD review of draft-ietf-6man-flow-update

From: RJ Atkinson <[email-masked]>
Date: Tue, 21 Jun 2011 09:03:54 -0400

Earlier, Brian Carpenter wrote:
> I'd have to trawl the archive to find all the arguments,
> but the main issue was that any attempt to include semantics
> in the bits of the flow label leads to complexity that
> probably can't be handled at line speed in a scaleable way.

That claim presumes that a typical IPv6 router is using CPU-based
packet forwarding.  I believe that assumption to be incorrect.
(By the way, this assumption underlies a lot of the discussion
on the IPv6 list.  Those of us who build ("have built", in my own 
case) real routers try to speak up about this from time to time,
apparently without having much impact on WG thinking.

I believe that most deployed IPv6 routers are using ASIC-based
or FPGA-based forwarding of IPv6 packets.  NP-based forwarding
is not uncommon, but is probably less common.  An advantage
of NP-based forwarding engines or FPGA-based forwarding engines
is that new capabilities can be added on the fly.  While some
deployed ASIC-based forwarding engines are programmable, most 
IPv6-capable ASIC forwarding engines are not programmable.

Even the really low-cost consumer electronics routers that 
support IPv6 generally do so via commodity silicon packet 
processors offered by a range of different merchant silicon 
firms based in various countries (example: Broadcom).

Since the majority of the lifespan of IPv6 is well into the 
future, and deployment today remains pretty small today,
compared with say 3 years from now, re-allocating those 4 bits 
seems entirely possible to me.

> Also 16 bits might make it too easy for a malicious party
> to predict flow label values.

That makes no mathematical sense to me.

To the extent 16 bits is problematic, 20 bits also would be
problematic.  So that argument also does not make sense to me.
Even if someone has formal maths behind that claim, which so far
I haven't seen claimed on the IPv6 WG list, Moore's Law would
defeat any claim that 20 bits is adequate within ~5 years.

Yours,

Ran

---

From: Brian E Carpenter <[email-masked]>
Date: Wed, 22 Jun 2011 01:48:19 +1200

Ran,

> seems entirely possible to me.

Anything's possible. I was trying to summarise what I recall
from the discussions that led to the WG consensus.

> defeat any claim that 20 bits is adequate within ~5 years.

Sure, we are talking about the difference between a brute force
attack with a million choices vs 65k choices; not a strong argument,
of course.

   Brian