Subject: [SAVA] SAVA problem statement comments

From: fergdawg at netzero.net (Fergie)
Date: Mon Mar 19 16:39:17 2007

-- Mark Williams <[email-masked]> wrote:

>I don't agree that the focus necessarily has to be on inter-ISP spoofing 
prevention. For example, if a mechanism could be found to force the 
deployment of BCP38 and loose uRPF in all providers and to verify that 
it had been deployed, then the need for inter-provider anti-spoofing 
would go away. I'm not saying I have any better ideas about how to make 
this happen, but if such a solution could be found then we could declare 
victory and go home.

>From a personal perspective (and as one of the co-authors), BCP38
really wasn't written with inter-ISP filtering in mind. Policy
implementations such as this need to pushed out to the edge of
the network hierarchy as much as possible, and as close to the
end-systems as much as possible -- and in my mind, this is a
perfect implementation focus for SAVA.

Cheers,

- ferg

--
"Fergie", a.k.a. Paul Ferguson
 Engineering Architecture for the Internet
 fergdawg(at)netzero.net
 ferg's tech blog: http://fergdawg.blogspot.com/

---

From: pekkas at netcore.fi (Pekka Savola)
Date: Mon Mar 19 17:55:01 2007

> perfect implementation focus for SAVA.

It's clear that BCP38 was not designed with inter-ISP in mind.  The 
real question, however, is what work is there to be done at 
non-inter-ISP scenarios?

I certainly can't see much potential work items for subnet spoofing 
prevention or intra-ISP; we already have BCP38, BCP84, IP/MAC/port 
locking, etc.  Spinning up a WG to work on intra-ISP or subnet 
scenarios is unlikely to help if we can't even identify the initial 
work items.

My take is that we already have adequate solutions for intra/subnet 
scenarios out there which just need better deployment.  (Documenting 
the 'roadmap' of these already existing solutions could also be done, 
but spinning up a WG to do so doesn't seem to be worth the effort.)

Unless we can identify before a WG would be chartered which protocol 
work is needed in intra-ISP/subnet scenarios, we're left with 
inter-ISP; that's where we already have a large number of proposed 
(from research world) solutions.  We can debate whether those 
solutions are feasible and useful from the IETF perspective.

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings