Subject: Re: Usage of ML Endpoint Discriminator Option

From: "John R. Martz" <[email-masked]>
Date: Fri, 27 Aug 1999 11:59:43 -0400

> Still, if you have any influence on this 2210 IBM product, and you have
> any reason to hope it does well in the market, it would be wise to exert
> your influence to make it less unreasonable.  A router that does not
> divulge its IP address is legal, but not reasonable and not competative.

Vernon,

Unfortunately I'm just a "dumb user". I've never configured this router myself so I can't give you a
definitive answer.

But I assume that it functions this way as a security feature. Just because the router HAS an IP
address doesn't mean you WANT it passed out to anyone who dials into it. Alternatively, the router's
IP address may be on a network that is intentionally not accessible to (most) folks who dial into
the router. Again, as a security feature. The harder it is for someone to talk directly to the
router the less likely it is that someone can hack into it.

In other words, I don't view this as a competative disadvantage at all. It's a feature. I'd also
speculate that even the routers you have worked with could exhibit be configured this way. No?

-john martz ([email-masked])
IBM AS/400 TCP/IP PPP (and stuff)

---

From: James Carlson <[email-masked]>
Date: 30 Aug 1999 07:02:21 -0400

[email-masked] ("John R. Martz") writes:
> But I assume that it functions this way as a security feature. Just
> because the router HAS an IP address doesn't mean you WANT it passed
> out to anyone who dials into it. Alternatively, the router's IP
> address may be on a network that is intentionally not accessible to
> (most) folks who dial into the router. Again, as a security
> feature. The harder it is for someone to talk directly to the router
> the less likely it is that someone can hack into it.

Three comments:

	1.  Obscurity != security.  Making it hard to get the IP
            address is not a security advantage.  Someone who does
            want the address will likely find it through other means.
            (What source address do you use if you support Path MTU
            Discovery?  What do you tell customers if you *don't*
            support it?)

	2.  There's no particular reason to apply the same security
            mechanisms to the "network" and the "dial-up" sides of the
            box.  Most routers have the ability to apply stricter
            access control to the dial-up lines.  Thus, knowing the
            "true" IP address of the box is not necessarily as useful
            on those dial-up lines as it might be on the Ethernet
            side.

	3.  The address that you hand out via IPCP need not be the
            "true" or "unrestricted" IP address of the box.  Handing
            out an IP address that happens to lead to a firewall or
            other security mechanism is perfectly acceptable.

> In other words, I don't view this as a competative disadvantage at
> all. It's a feature. I'd also speculate that even the routers you
> have worked with could exhibit be configured this way. No?

Yes, many can.  I side with Vern on this one, though:  setting it up
that way isn't a feature.  It's a bug.

-- 
James Carlson, System Architect                     <[email-masked]>
IronBridge Networks / 55 Hayden Avenue   71.246W   Vox:  +1 781 372 8132
Lexington MA  02421-7996 / USA           42.423N   Fax:  +1 781 372 8090
"PPP Design and Debugging" --- http://people.ne.mediaone.net/carlson/ppp