Subject: [MEXT] Verifying Multiple CoA Bindings

From: "Ivancic, William D. (GRC-RCN0)" <[email-masked]>
Date: Tue, 4 Dec 2007 12:29:05 -0600

Benjamin,

On page 9 last paragraph:
 
"To reduce the need for
   mobile node to send at least one packet from each interface, the home
   agent could send a notification to a mobile node via one unverified
   care-of address and ask the mobile node to respond to the reception
   of the notification via another care-of address. "

This is probably not a workable solution for validating the CoA
Bindings.  The security provided by firewalls probably make this
technique unworkable.  As my collegue often points out Security - The
Ultimate Denial Of Service - TUDOS!

Will

_______________________________________________
MEXT mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mext

---

From: "Benjamin Lim" <[email-masked]>
Date: Thu, 6 Dec 2007 01:36:45 +0800

Hi Will,

Thanks for your comment.

I believe that the test packet coming to the MN can be carried in packets
that might be able to traverse the firewall (e.g. ICMP packet). Otherwise,
the mip6-firewall draft might be employed here.

Regards,
Benjamin Lim 

> -----Original Message-----
> From: Ivancic, William D. (GRC-RCN0) 
> [mailto:[email-masked]] 
> Sent: Wednesday, December 05, 2007 2:29 AM
> To: [email-masked]; [email-masked]
> Subject: Verifying Multiple CoA Bindings
> 
> 
> Benjamin,
> 
> This is probably not a workable solution for validating the 
> CoA Bindings.  The security provided by firewalls probably 
> make this technique unworkable.  As my collegue often points 
> out Security - The Ultimate Denial Of Service - TUDOS!
> 
> Will
> 
>