Subject: Re: [RPSEC] another example of peering topology check not catching

From: Sandy Murphy <[email-masked]>
Date: Mon, 14 Mar 2005 11:06:36 -0500 (EST)

>I can't think of many others that I would try to get into securing--it's a 
>huge black hole....

Note that the problem is not only "should we make this behavior secure".
The problem is also "can the security protections make the behavior
impossible".  Or even "*should* the security protections make this
behavior impossible".

--Sandy

_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

---

From: Russ White <[email-masked]>
Date: Mon, 14 Mar 2005 11:21:04 -0500 (Eastern Standard Time)

>> I can't think of many others that I would try to get into securing--it's 
>> a huge black hole....
>

>From a traffic flow point of view, no, the security mechanism can't make 
this impossible. Making it impossible from a routing point of view would 
really require not doing aggregation, I think.

I also think we might need to be able to justify why we're worried about 
this sort of behaviour, and not a host of other types of behaviours.... I 
think we can justify this to some degree, but it gets harder and harder to 
"draw the line" with every step over...

:-)

Russ

__________________________________
[email-masked] CCIE <>< Grace Alone