Subject: [rbridge] TTL only - was RE: New fields in shim header?

From: sgai at nuovasystems.com (Silvano Gai)
Date: Thu, 12 Oct 2006 13:26:03 -0700

Catlin,

I didn't reply to your last point

> 
> I am assuming there is no desire to replicate IPSEC funcationality
> at L2 then *all* of the L2 headers may be forged. I don't see how
> you can claim that any specific one is more trustworthy than
> the others.

Even without IPsec, RBridges can authenticate to each other and forging
an RBridge is much more difficult that using a readily available program
on your PC to spoof the IP or MAC address.

-- Silvano

---

From: touch at ISI.EDU (Joe Touch)
Date: Thu, 12 Oct 2006 13:30:08 -0700

> on your PC to spoof the IP or MAC address.

I don't need to spoof another rbridge to inject spoofed traffic; I just
need to see the traffic going by; I can do that by plugging in a hub and
running tcpdump.

Joe

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 250 bytes
Desc: OpenPGP digital signature
Url : http://mailman.postel.org/pipermail/rbridge/attachments/20061012/f55c5bf5/signature.bin

---

From: caitlinb at broadcom.com (Caitlin Bestler)
Date: Thu, 12 Oct 2006 13:37:23 -0700

Silvano Gai wrote:
>> I am assuming there is no desire to replicate IPSEC funcationality at
>> L2 then *all* of the L2 headers may be forged. I don't see how you
>> can claim that any specific one is more trustworthy than the others.
> 
> Even without IPsec, RBridges can authenticate to each other
> and forging an RBridge is much more difficult that using a
> readily available program on your PC to spoof the IP or MAC address.
> 
> -- Silvano

I wouldn't be surprised if RBridges ending up authenticating
to each other as part of fabric discovery. But clearly there
will be no high quality authentication applied at L2 on a 
per packet basis.