Subject: DARPA get's it right this time, takes aim at IT sacred cows

From: Jeff Williams <[email-masked]>
Date: Sat, 13 Mar 2004 02:48:51 -0800

All former DNSO GA members or other interested stakeholders/users.

  Seems that the self styled "father of the internet", Vinton Cerf's
IP [ Internet Protocol ] has finally begun to be recognized as
obsolete for wireless networking.  Not that this is all that unknown
as several stakeholders/users on this forum reached that conclusion
some three years ago now in discussions and debates on this
forum.
See article:  http://www.gcn.com/vol1_no1/daily-updates/25240-1.html

Regards,

--
Jeffrey A. Williams
Spokesman for INEGroup LLA. - (Over 134k members/stakeholders strong!)
"Be precise in the use of words and expect precision from others" -
    Pierre Abelard

"If the probability be called P; the injury, L; and the burden, B;
liability depends upon whether B is less than L multiplied by
P: i.e., whether B is less than PL."
United States v. Carroll Towing  (159 F.2d 169 [2d Cir. 1947]
===============================================================
Updated 1/26/04
CSO/DIR. Internet Network Eng. SR. Eng. Network data security
IDNS. div. of Information Network Eng.  INEG. INC.
E-Mail [email-masked]
 Registered Email addr with the USPS
Contact Number: 214-244-4827

---

From: "Anthony G. Atkielski" <[email-masked]>
Date: Sat, 13 Mar 2004 11:08:31 +0100

Jeff Williams writes:

> obsolete for wireless networking.

As compared to what?

---

From: Scott Michel <[email-masked]>
Date: Sat, 13 Mar 2004 18:48:04 -0800

DARPA's network research direction has been somewhat aenemic over the last
couple of years, given the force protection focus and GWOT mission to
which DARPA has adapted. It's pretty easy to overreact to the DARPAtech
stuff, esp. when a PPT slide or news article says "IP is broken".

IP isn't broken. From a program management perspective, "IP" is merely
referring to a large number of interacting protocols, from the lowest
level physical layer to the application layer. If one reads the article
with a little more care and not as a manifesto, DARPA is interested in a
protocol suite where static (wired) networks are a special case. What
exists is a network system where the dynamic (mobile/unwired) network mgmt
is grafted onto the static network, treating the dynamic network as a
special case. DARPA wants to change the way protocols are designed, where
the network is primarily designed for dynamic nodes (and all of the
overhead that entails). I wouldn't read much more into the program
statements than that, despite the fact that controversy makes good press.

One really good example of what the program is most likely aiming toward
is the MIT RON research. It's not the IP routing protocols or the 2-tier
routing hierarchy that's broken, it's the fact that these protocols
converge so slowly to repair the network. Thus, RON is successful in the
fact that traffic can continue to get to its destination via the RON
overlay despite the routing reconvergence and the time it takes for
reconvergence. Currently, RON claims to improve reliability by orders
of magnitude rather than fixing routing protocol brokeness.

The article also mentioned something along the lines of "Redesign The
Seven Layer Model!" Frankly, I've always preferred the four layer IETF
model because it didn't have the extra useless layers; but hindsight is
20/20, after all. I could look at the ceiling and foresee the session
and presentation layers suffering the death they truly deserve, but
the remaining layers staying intact. Layers may need subdividing or even
outright addition to the current model so that overlays and the recovery
semantics they provide are more explicit.

SMTP is not a good example of what's wrong with IP and I'm not even sure
why COL Gibson or the other presenters even used what's arguably the most
successful Internet protocol example. As the article points out, SMTP's
promises are pretty weak regarding whether e-mail gets delivered, if at
all, or the timeliness with which delivery occurs. Then again, the USPS
doesn't make any strong promises either for regular letters. When the USPS
does make promises, you pay extra for them, and even then, delivery
confirmation is not a gauruntee if the return address is hosed.

Of course, if DARPAtech had worded their presentations with less
controversy, most participants would have yawned and said "Oh, yeah,
business as usual -- nothing interesting here." Death and complete
redesign of IP? Not likely in my lifetime 'cos "It just works, mate!"

---

From: "Stephen Sprunk" <[email-masked]>
Date: Sat, 13 Mar 2004 21:44:12 -0600

Thus spake "Scott Michel" <[email-masked]>
> If one reads the article with a little more care and not as a manifesto,
> DARPA is interested in a protocol suite where static (wired) networks
> are a special case. What exists is a network system where the dynamic
> (mobile/unwired) network mgmt is grafted onto the static network,
> treating the dynamic network as a special case. DARPA wants to
> change the way protocols are designed, where the network is primarily
> designed for dynamic nodes (and all of the overhead that entails).

This sounds to be heading back into the recurring debate about separating
locators and identifiers...  Too bad it's probably too late to add that into
IPv6.

S

Stephen Sprunk        "Stupid people surround themselves with smart
CCIE #3723           people.  Smart people surround themselves with
K5SSS         smart people who disagree with them."  --Aaron Sorkin

---

From: Eliot Lear <[email-masked]>
Date: Sun, 14 Mar 2004 08:46:17 -0800

While in general I agree with what Scott Michel there is one point of 
controversy no-so-hidden in his message:

> semantics they provide are more explicit.

I agree.  The subdividing has begun.

Say what you will, but in large portions of the Internet we are no 
longer a four layer stack.  Between VLANs, IPsec VPNs, and MPLS, we've 
inserted a few more layers.  It goes back to Steve Deering's hourglass 
presentation.  We can argue over their usefulness.

While I've not been witness to an argument about the usefulness of the 
presentation layer, I have been witness to huge arguments over the 
session layer that go on to this day.  Arguably we have some advances to 
make, and the existence of a HIP working group seems to indicate the 
usefulness of something above Internet and below transport, while the 
ADD-IP improvements in SCTP in an odd way validate some of what those 
session layer folk were going for.  Perhaps with ADD-IP we have what 
amounts to a "pseudo-session-layer".

Anyway, bar room talk for San Diego.  I hope to see you there.

Eliot

---

From: jfcm <[email-masked]>
Date: Mon, 15 Mar 2004 14:07:19 +0100

Dear Scott,
Interesting as this matches the conclusions of our own meetings in Dec/Jan
on national vulnerability to internet.

>stuff, esp. when a PPT slide or news article says "IP is broken".

Agreed. But for a non US observer this sounds in line with the pro-IPv6
stance of DoD: obeying http://whitehouse.gov/pcipb marching orders.

IPv6. IPSec, DNS and Gateway protocol redesign (more detailed, may be,
in preparatory 2002/11/15 document)?

>statements than that, despite the fact that controversy makes good press.

May be am I candid, but I tend to think that when a military person speaks,
it is with a purpose. And usually that telling what you exactly want is the
best way to obtain it. The article does not say they want to kill IP, but
that they want solutions. There are three possibilities to support changes:

- to fix IP
- to change IP
- to replace IP

I would read they are interested in the three of them, in parallel.

I read they have identified a need (the same as NSI said they had a need
through PathFinder) and that the ball is in the IAB and IETF's field (for a
short while if you consider how long NSI awaited before suing ICANN)

Let us hope reactions in here will be more positive than to Richard Clarke.
Or to my own December queries..

>of magnitude rather than fixing routing protocol brokeness.

Let see the situation through military eyes. The battlefield is what it is.
For the new Cyber Forces, the internet battlefield is what is used
today. So they are interested in what is available/under serious
development - or in what worked before/aside the IP technology and
which could be deployed quick (so, most probably a total change for
a clean sheet, low cost and confidential restart).

They also want to get their own controlled solutions. The same as an
Army uses existing bridges and bridges, even poor ones. The same
it mends them if needed. And builds it own ones when necessary.

May I suggest, that these guys' priority is not really to respect RFCs,
but to protect your lifes?

>semantics they provide are more explicit.

Real life is not monolithic. Fighting for one model against another is
a very strange idea. Would aggregating models, so they may have
some consistency (as the low layers do) and synergy, and picking the
one which works for each task at hands, not be a more pragmatic and
scientific approach?

>successful Internet protocol example.

May I suggest that the example is good as an image. Datagram,
mail, file concepts are part of the "postal like" paradigm of the 60s.
This paradigm is that everyone can send you a text and you sort
them when received. You are to authentify every piece of data
you receive and can be subject to saturation deliveries (DoT, spam,
viruses). Under this paradigm you defend yourself at your gate,
like a fort. You are under enemies's fire.

You may imagine other paradigms where you protect yourself
remotely. And put the enemies under your own fire first, and protect
your communications lines.

>redesign of IP? Not likely in my lifetime 'cos "It just works, mate!"

In my own lifetime I saw three working technologies (based upon
three different paradigms) used for what the users name "internet"
today (Tymnet, OSI, Internet). Only the first one supported them
three (as well as most of the leading private ones).  And whet I
hear every where is "when you think of it, it just does not work".
So I suspect I will see one or two other ones.

Why not to have a try at:

- analyzing an extended network model where the datacoms
various models and layers are encapsulated into the physical,
operational and usage layers?

- accepting that the datacoms ecosystem needs to support many
different data and objects granularities, including the current IP
ones. And to have a try at a universal packet protocol, starting
from IP as the prevalent one, and progressively extended its
capabilities?

- working also on a progressive unification of the same layers,
across models, when possible. To maintain the funding uniity
and the consistency a distributed system needs.

jfc

---

From: Scott Michel <[email-masked]>
Date: Mon, 15 Mar 2004 12:04:20 -0800

> I agree.  The subdividing has begun.

But the subdivisions aren't explicit and don't have a functional definition. 
The sublayers needs an explicit enumeration of their relationship with the 
higher and lower levels, much like the "Transport" layer encompasses and 
specifies the relationship of transport protocols over the Network layer.

-scooter

---

From: Scott Michel <[email-masked]>
Date: Mon, 15 Mar 2004 12:45:29 -0800

> on national vulnerability to internet.

Sounds like the internet is a threat, not a tool. (Ok, I know you're not a 
native English speaker, but it was hard to resist.)

> stance of DoD: obeying http://whitehouse.gov/pcipb marching orders.

To be fair, it was NATO and the Allies who started in the v6 direction 
first. DoD is just merely keeping up with its various international partners.

> that they want solutions. There are three possibilities to support changes:

Generally speaking, military officers do speak with a purpose in mind, but I 
disagree that the thrust you're enumerating. "Fix IP" is probably true, 
"Change IP" fits with "Fix IP", but "Replace IP" is patently untrue. After 
all, the DoD spent a lot of time and money on ATM in the mid and late 90's 
only to fall back to IP. ATM was an abject failure.

> short while if you consider how long NSI awaited before suing ICANN)

I'm not sure I agree with this at all -- the research community is much more 
agile than the IETF and IAB, so it's more likely that the IETF will play 
catch-up as the DARPA reearch produces tangible results.

> a clean sheet, low cost and confidential restart).

The emphasis is and has been "network centric warfare". The current DARPA 
director is interested in a good mix of solutions that can be deployed in 
the immediate, near and future terms. "Deployed" as in "deployed out in the 
field with the warfighter" (on the back of a US Marine.)

Throwing away the current IP infrastructure or completely redesigning the 
protocols would be one of those way off in the future projects and has very 
little chance for success (refer to the DoD and ATM as a good example.)

Your army combat engineer example is a fairly decent metaphor for what the 
proposed programs want, but throwing away IP is not a tenable solution.

> but to protect your lifes?

Protecting the warfighter's life, actually.

> one which works for each task at hands, not be a more pragmatic and

No, real life is not monolithic, but invariant models like the 4- and 
7-layer models describe real systems and relationships. This was true a few 
minutes ago when last I looked at mathematics and physics, and their success 
at describing real world phenomena.

I'm not saying the model is complete, just like physics is still looking for 
its TOE model. But the model isn't completely wrong, either. Augmenting the 
4- and 7-layer models with what's been learned is a substanstive effort that 
will produce results, but somewhere, someone has to propose what's missing 
and what needs to be added.

> May I suggest that the example is good as an image. 

SMTP's problems are a better example of what's needed, not of what's wrong. 
I'd vehemently argue that SMTP isn't broken because it works. If one is 
going to replace SMTP, the replacement had better do what SMTP now does. 
SMTP does show its age from its origins in batch-mode processing days, but 
there comes a point at which "plus ca change, plus c'est la meme chose" when 
applied to new solutions.

> operational and usage layers?

So long as it stays in 3 dimensions, which is what most people can tractably 
handle. If it can't be easily visualized, it's not going to be successful. 
Also keep in mind that humans aren't particularly good at drawing 3d 
diagrams on paper (I'd argue that's one of the successes of the 2d layer 
diagrams.)

> from IP as the prevalent one, and progressively extended its

Well, sure, that makes sense, but I'm going to doubt that you're going to 
find an universal packet protocol that's any more universal than IP.

As one other responder said, there is a need to accomodate different 
addressing styles that separate identity from location. I agree with the 
sentiment. So, [erhaps it is only necessary and sufficient to extend or 
redefine IP's addressing?

Or perhaps it's only necessary and sufficient to design a universal 
application-level forwarding layer? (Warning: plug for my own research 
called FLAPPS, http://flapps.cs.ucla.edu/)

---

From: jfcm <[email-masked]>
Date: Tue, 16 Mar 2004 10:39:25 +0100

>native English speaker, but it was hard to resist.)

It sounds right. The threats are the weaknesses of the tool. And their 
impact on cirtical resources.
Let assume the DNS "stops" (attacked, polluted, hijacked, disputed): what 
is the impact on the nation?

We identified five main (immediate/middle terms) threats (and agree with 
the USG they may be critical [we say "vital"]):
- DNS centralization
- IPv6 unique numbering plan
- mail usage architecture (not SMTP)
- governance confusion
- non concerted national R&Ds (starting withthe US one)

This lead to the notion of "national firewall". Not the same architecture 
and layers as a local firewall, but an equivalent mission. One can consider 
global, users groups and local firewalling. Global means to prevent 
destructive access to the nets (like sending spammers to jail, making sure 
the root is stable, secure and safe, reaction to PathFinder like attempts). 
Users Groups (nations, regions/states, cities, structures, coporations 
etc.) mean addressing, directory, access portall protection. Local is what 
we are used to (but here port and traffic filtering should be less and less 
the main issue and call for more sophisticated tools).

>first. DoD is just merely keeping up with its various international partners.

hmmm. May be you did not evaluate what the worldwide control of IPv6.001 
gives to who allocates the addresses (ICANN) and whould build an run an 
IPv6 "DNS".

>Generally speaking, military officers do speak with a purpose in mind, but 
>I disagree that the thrust you're enumerating. "Fix IP" is probably true, 

I will not comment on ATM. "Fix IP" means in my mind to keep IPv4/IPv6 and 
modifiy some features. "Change IP" means to look at a new IPvX. "Replace 
IP" means another kind of protocol/paradigm. I do not talk abuot what DARPA 
may do, but what we have as options.

>I'm not sure I agree with this at all -- the research community is much 
>more agile than the IETF and IAB, so it's more likely that the IETF will 
>play catch-up as the DARPA reearch produces tangible results.

I think we agree there. I say the ball is in IAB/IETF field, and that they 
have to move fast, or DARPA and many others will take the lead.

The problem is that this "agility" is to be housed somewhere. Let assume 
DARPA produces tangible results soon (what I is quite credible) we are not 
in the 80s anymore, on "ARPA Internet". We are on Global Internet, and a 
Global body is to publish it. This leads to ITU. And as long as ITU-I has 
not been created on purpose, I am afraid it is acceptable to no one.

>the immediate, near and future terms. "Deployed" as in "deployed out in 
>the field with the warfighter" (on the back of a US Marine.)

We agree. But we are considering today/tomorrow warfare. The Irak action 
started with the first real "cyberbattle", a two days saturation spamming 
preparation. Exactly like before a Marines landing with artillery (what 
they had on the boarder too if I am right?).

Snipers coordinate through cyberspace. Soft unstabilization of Europe is 
hopefully right now a cyber activity, rather than a Marines one :-).

>protocols would be one of those way off in the future projects and has 
>very little chance for success (refer to the DoD and ATM as a good example.)

Throwing away current IP would be stupid. Because it is here. But we all 
know that IP cannot support most of what we miss today (in most of the 
cases this is the reason why we miss them).

>Protecting the warfighter's life, actually.

hmmm. I think you really need to read http://whitehouse.gov/pcipb. The 
documented priority is not only the warfighter's life, but the nation's 
life and way of life, in protecting critical installations and systems. 
SCADAs are a priority. I agree that DARPA looks also how to quickly deploy 
responses for urban warfare. But it is "also". All the more than 
cyberwarfare is a very important key to urban warfare.

>7-layer models describe real systems and relationships. This was true a 
>few minutes ago when last I looked at mathematics and physics, and their 
>success at describing real world phenomena.
>
>I'm not saying the model is complete, just like physics is still looking 
>for its TOE model. But the model isn't completely wrong, either. 
>Augmenting the 4- and 7-layer models with what's been learned is a 
>substanstive effort that will produce results, but somewhere, someone has 
>to propose what's missing and what needs to be added.

Full agreement. My model - somewhat validated over the last 20 years - is 
not "augmented" but aggregating (and augmented thourgh operation and usage 
layers/parts). If the 4, 7 or any other model work for aspecific need, it 
is just fine, as long as all the models are permitted to interact.

>SMTP's problems are a better example of what's needed, not of what's 
>wrong. I'd vehemently argue that SMTP isn't broken because it works. If 
>one is going to replace SMTP, the replacement had better do what SMTP now 
>does. SMTP does show its age from its origins in batch-mode processing 
>days, but there comes a point at which "plus ca change, plus c'est la meme 
>chose" when applied to new solutions.

Full agreement. You were objectng that SMTP was not a good image: I just 
responded it was a good icon of what basically is flawed - ie the "open 
postal" concept which permits spoofing to be a global conceptual component.

Now, I do not only agree about SMTP, but I think it suffered to be too much 
enhanced. You were objected about "batch processing" days. I understand 
what you mean. OK, the "mail" concept was first used to report on the 
success of a "batch" (script). And I do not really understand what would be 
wrong about "batch" - this is only a sophisticated repetitve or one shot 
command. An SQL request is a batch. Interactive commands only is irrealistic.

To come back to SMTP, you are right. Degrade SMTP to its minimum (full 
compatibility with existing deployment) and use it only as an ubiquitous 
signaling transport system in a store and retrieve architecture (memory 
sharing). You then have a good and fully compaitible transition to the next 
network paradigm.

>So long as it stays in 3 dimensions, which is what most people can 
>tractably handle. If it can't be easily visualized, it's not going to be 
>successful. Also keep in mind that humans aren't particularly good at 
>drawing 3d diagrams on paper (I'd argue that's one of the successes of the 
>2d layer diagrams.)

Full agreement.

The model I use is only partly 3D (a cylinder figured through half a 
covering elipse on the top - like an open binder you would look from the 
cover side). This is only to show two things:
- the unlimited continuity there should be at the same layers - whatever 
the layers may be. And to sort it (like from individual to groups)
- the fact there are common spines.

The 2d layer diagrams are good as snapshots. My "binder" parabole pemits to 
show they are only snapshots which are to fit together. And that they have 
some elements/constraints in common.

>find an universal packet protocol that's any more universal than IP.

:-) Wich IP ?

The point is not in defending IP or not. But in taking advantage from 
accumulated experience, demands etc. and to have a cleen sheet review. If 
the result is IP, just fine. But I doubt it. May be not far from it, but I 
doubt it, because IP is datagram only.

>redefine IP's addressing?

I fully agree with this. I propose IPv6.010 numbering scheme to be defined 
as a universal technology+routing+addresing+sub-adressing scheme. For that 
reason and to validate IPv6 as a multi-numbering-plan solution. If we do 
not start with 2 plans, how will we be sure IPv6 protocol, softwares and 
equipement are multi-numbering-plan compliant?

>called FLAPPS, http://flapps.cs.ucla.edu/)

Very interesting. Right in what I currently consider :-)

1. fits in what I name interapplication layer. This is also memory sharing, 
what is (IMHO) one of the ways to the future. Coupled with SMPT or SMS, or 
whatever you like for signal/script command sending. Please note that this 
is datacoms model independent. Replace IP by X.25: your model is unafected, 
if I read it correctly ?

2. this is an attempt to a generalization of the "peer to peer" concept: I 
use "tier and tier" (3&3). Like in the street or on the phone. There is no 
other prerequiste than to be layer compatible.

Did this research lead to working solutions? The real point is memory 
sharing. But universalization cannot come from peer to peer and higher, 
because it calls for real people to group first. But it can come from 
private continuity management. if you use a solution to organize your own 
virtual system, in addition you become compatible with any tier using the 
same solution.

Thank you.
jfc

---

From: Scott Michel <[email-masked]>
Date: Tue, 16 Mar 2004 16:52:57 -0800

> - non concerted national R&Ds (starting withthe US one)

You've managed to identify operational problems, not protocol problems. The 
Internet's continued operation may face some serious challenges if certain 
trends continue, vraiment. It's not a compelling reason for a "national 
firewall" as you described. At the risk of being particularly crass, it 
sounds a lot like building the Internet equivalent of the Maginot line.

It's a noteworthy proposal, as you described it, but the management of such 
an entity would be hideous. Even if the management and policies of Internet 
operation/management could be compartmentalized as you describe, you'd still 
have roughly the same problems with domain names, address allocation, etc. 
I'm not sure I see what the advantages would be.

> gives to who allocates the addresses (ICANN) and whould build an run an 

A few years back, I was a co-author on a few whitepapers for customers who 
were wondering whether they should head down the IPv6 road because European 
partners were already heading down that road. I'm familiar with some of the 
history.

> DARPA produces tangible results soon (what I is quite credible) we are 
> not in the 80s anymore, on "ARPA Internet". We are on Global Internet, 
> and a Global body is to publish it. This leads to ITU. And as long as 
> ITU-I has not been created on purpose, I am afraid it is acceptable to 
> no one.

I was waiting for the ITU to get dragged into this discussion. Yup, the same 
folks who brought us all of the other unsuccessful networking standards. 
Sorry if I'm biased here, but as it is said, history books are written by 
the winners. So, getting back to that discussion about ATM... :-)

> started with the first real "cyberbattle", a two days saturation 
> spamming preparation. Exactly like before a Marines landing with 
> artillery (what they had on the boarder too if I am right?).
> 

What you're referring to is not network-centric warfare at all. You're 
referring to a specific tactic in the psychological warfare operations side 
of the military. It's a important as the "kinetic response" (USAF and USN 
dropping bombs, the USMC landing ashore, etc.) It's merely part of attacking 
a national infrastructure just as much as reducing electrical power plants 
to rubble attacks a national infrastructure's capabilities.

Network-centric warfare has nothing to do with psyops. N-C has more to do 
with command and control of assets deployed to a theater, assessing and 
prioritizing threats, etc.

> SCADAs are a priority. I agree that DARPA looks also how to quickly 
> deploy responses for urban warfare. But it is "also". All the more than 

DARPA and DHS (and its DHSARPA) are two separate entities with different 
missions. DARPA's focus is the warfighter, DHSARPA's focus is homeland 
security. The two missions may be integrated via a White House position 
paper but it takes the two agencies to execute the vision.

BTW: DARPA doesn't deploy anyone to anywhere... it does research and 
evaluation. The respective military service branches deploy people to places 
using technologies that may have been influenced by DARPA research or 
evaluated by DARPA (e.g., Internet, M-16s, ceramic armor, UAVs, etc.)

> - the fact there are common spines.

Your model still sounds much to complex for ordinary mortals to grasp. While 
it sounds like it should show the interactions between layers of different 
types and models cleanly, it would probably be sliced apart by Occam's 
Razor. This is why the 4- and 7-layer models work so well: they are the 
simplest models that suffice.

>> Well, sure, that makes sense, but I'm going to doubt that you're going 
>> to find an universal packet protocol that's any more universal than IP.
> 
> 
> :-) Wich IP ?

Take your pick. Something that resembles the packet oriented system we all 
love and enjoy. Addressing schemes allow IPv<whatever> to grow and evolve, 
but the underlying philosophy behind it still remains the same.

> I propose IPv6.010 numbering scheme to be 
> defined as a universal technology+routing+addresing+sub-adressing 
> scheme. For that reason and to validate IPv6 as a multi-numbering-plan 
> solution. If we do not start with 2 plans, how will we be sure IPv6 
> protocol, softwares and equipement are multi-numbering-plan compliant?

At which point, we're back to a complete mess again when the all 
"stakeholders" get the different addressing schemes that make just about 
everyone happy. Or at least fall into the proverbial "While you can please 
some of the people some of the time, you can always piss off all people all 
of the time."

Of course, multiple addressing schemes tend to beg the question of "Why have 
two if one suffices?" (the usual necessary and sufficient argument, Occam's 
Razor again) Which leads full circle back to identifiers vs. locators. Wash. 
Rinse. Repeat.

> private continuity management. if you use a solution to organize your 
> own virtual system, in addition you become compatible with any tier 
> using the same solution.

FLAPPS stemmed from the URL-based routing and forwarding work in web caching 
I did a number of years ago with another advisor. It's 70,000 lines of code 
and will hopefully be more widely available after I graduate. Yes, the code 
has been demonstrated to do what it claims, but the glaring part missing is 
DHT emulation -- which I've tried to avoid, but will have to do in order to 
satisfy recurring reviewer comments.

---

From: "Stephen Sprunk" <[email-masked]>
Date: Tue, 16 Mar 2004 19:09:12 -0600

> redefine IP's addressing?

When you add in the (assumed) requirements of backwards compatibility with
existing routers and hosts that don't implement a proposed extension, it
gets messy real quick.

HIP is a good start, but it's still only a BOF and the involvement is
nowhere near what one would expect for (IMHO) the most significant IETF
project since IPv6.

> called FLAPPS, http://flapps.cs.ucla.edu/)

While that's certainly interesting in its own right, what I think DARPA (and
the IETF) is looking for is something between the network and transport
layers, not something above transport.

S

---

From: Scott Michel <[email-masked]>
Date: Tue, 16 Mar 2004 17:35:11 -0800

> existing routers and hosts that don't implement a proposed extension, it

The immediate handwave would be "Tunnel it." I'm not denigrating backwards
compatibility, but a lot of good work has relied on tunneling in the past,
e.g., Mbone and v6-v4. I'm currently waiting with baited breath the day
that service providers provide v6-to-v4 as the special case to v4-only
hosts.

> nowhere near what one would expect for (IMHO) the most significant IETF

Must find more copious free time. Must find more copious free time.

> layers, not something above transport.

You never know until you submit a proposal what DARPA **really** wants
even after you get through the program-speak. FLAPPS got funded for a while
under the Fault Tolerant Networks program, as did a lot of other research.

Might be that there are multiple shim layers between network and transport,
transport and application. That said, a lot of things can be solved in the
application layer (or adding thin layers underneath the app layer) because
adding them to the network and transport layer is less tractable. A good
example is multicast -- it works well and fits into the network layer but
the problems with routing protocols to get the distribution tree built turns
out to be a long IETF standards process exercise. Application-layer mcast
seems to be more of a winner than network-layer (just my perception, you
may now fire at will.)

In any case, it's fuel for interesting discussions.

-scooter

---

From: "Stephen Sprunk" <[email-masked]>
Date: Tue, 16 Mar 2004 20:54:30 -0600

> > When you add in the (assumed) requirements of backwards compatibility
> > with existing routers and hosts that don't implement a proposed
extension,
> > it gets messy real quick.
>
> The immediate handwave would be "Tunnel it." I'm not denigrating
> backwards compatibility, but a lot of good work has relied on tunneling in
> the past, e.g., Mbone and v6-v4. I'm currently waiting with baited breath
> the day that service providers provide v6-to-v4 as the special case to
> v4-only hosts.

The Mbone and 6bone are different beasts, as they're about tunneling traffic
from capable hosts across an incapable core.  In the case of an identity
layer between IP and TCP, we would need to be backwards-compatible with
non-capable hosts and applications (not just non-capable routers) and so
tunnels don't seem a workable solution.

> > nowhere near what one would expect for (IMHO) the most significant
> > IETF project since IPv6.
>

Ditto...

> even after you get through the program-speak.

All too true.  We do, however, know many of the IETF's needs in the
identifier/locator arena, e.g. for Mobile IP and IPv4/6 multihoming.  That
may be a good starting point to determine what, if any, additional
requirements DARPA has.

S

---

From: jfcm <[email-masked]>
Date: Thu, 18 Mar 2004 12:40:31 +0100

At 01:52 17/03/04, Scott Michel wrote:
>You've managed to identify operational problems, not protocol problems. 
>The Internet's continued operation may face some serious challenges if 
>certain trends continue, vraiment. It's not a compelling reason for a 
>"national firewall" as you described. At the risk of being particularly 
>crass, it sounds a lot like building the Internet equivalent of the 
>Maginot line.
>
>It's a noteworthy proposal, as you described it, but the management of 
>such an entity would be hideous. Even if the management and policies of 
>Internet operation/management could be compartmentalized as you describe, 
>you'd still have roughly the same problems with domain names, address 
>allocation, etc. I'm not sure I see what the advantages would be.

I am afraid you confuse layers. You can understand "firewall" as a traffic 
filter (what you obviously consider here): this would be obviously absurd 
fro what I address. You can also consider it as the appropriate protection 
for the considered layers, what we mean. If you want an exemple, look at 
Intelliwall (http://www.bee-ware.net). They are addressing the firewalling 
of applications. Traffic filtering is really the third lowest level (after 
electric and frame protection).

I will address the point more generally at the end - when discussing FLAPPS.

>were wondering whether they should head down the IPv6 road because 
>European partners were already heading down that road. I'm familiar with 
>some of the history.

Let not confuse the IPv6 protocol and the various IPv6.001,010, 011,etc. 
numbering plans.
I am only talking about numbering plans. Which may outlive or be 
independent from IPv6.

>>ITU-I has not been created on purpose, I am afraid it is acceptable to no one.
>
>I was waiting for the ITU to get dragged into this discussion. Yup, the 
>same folks who brought us all of the other unsuccessful networking 
>standards. Sorry if I'm biased here, but as it is said, history books are 
>written by the winners. So, getting back to that discussion about ATM... :-)

I said I would not comment on ATM. Another story.

>referring to a specific tactic in the psychological warfare operations 
>side of the military. It's a important as the "kinetic response" (USAF and 
>USN dropping bombs, the USMC landing ashore, etc.) It's merely part of 
>attacking a national infrastructure just as much as reducing electrical 
>power plants to rubble attacks a national infrastructure's capabilities.
>

Here you talk of N-C as ABC.
I am talking of cyberspace (or e-space), as there is airspace, outerspace, 
sea, or land
... and joint operations.

>paper but it takes the two agencies to execute the vision.

Decision to puts Cybersecurity under DHS responsibility postdates the 
threats evaluation first report (Sept 15, 2002). Reads the Whitehouse 
documents: obviously a lot goes to DHS but many other things go to the 
Administration at large. Let not confuse teh way it is responded today and 
the instrinsic nature of the evaluated threats.

IPv6.001 is mainly an external affairs.
As foreigners we see it to fall under responsibility of SD for the ITU 
related world relations aspects and of the DoD for the world control 
aspects (let not confuse network ancillary sevices for other forces and 
Cyber Force). Army has crafts and boats. Navy and Army have airplanes. In 
addition we are just starting, and we are here i na grey area. Like for 
Airforces in 1913.

>evaluation. The respective military service branches deploy people to 
>places using technologies that may have been influenced by DARPA research 
>or evaluated by DARPA (e.g., Internet, M-16s, ceramic armor, UAVs, etc.)

agreed. I said "looks how to", not "deploys".

>Your model still sounds much to complex for ordinary mortals to grasp. 
>While it sounds like it should show the interactions between layers of 
>different types and models cleanly, it would probably be sliced apart by 
>Occam's Razor. This is why the 4- and 7-layer models work so well: they 
>are the simplest models that suffice.

No. 4/7 models and the other many same occurences are differnt views of the 
same continuity. They work well (?) for their share of the reality. But 
globbaly they do not work well from the user point of view.

Your quote of Occam's Razor is great. The ENS model is a full cybernetics 
integrated model. Cybernetics has actually two successive slightly 
different understandings (I would say before and after the e-networks). The 
way Wienner, Ampere or Watts first thought of it. You would name it today 
organization "governance" (from Plato's "kubernetes", the way/art of 
steering, governing - like in Oxford/Cambridge race - steer and row - the 
proposition of McLean to the ITU meeting on governance). A top-down 
approach where the brain or a team (agora) is the leader (monarchy/athenic 
democracy). Centralized or meshed networks (ICANN, ISPs, Gateway Protocols).

The second understanding, we could call generalized cybernetics, is the 
arts of efficiency in using models discovered from feedbacks (Couffignal). 
This understanding is necessary in distributed systems like the USERs' 
demanded internet, where authority is not delegated anymore (monarchy) or 
shared (democracy) but retained by each participant. Then you consider 
granularity, not hierarchy (hirearchy is  just the most simple ordained 
occurence of a granularity of decreasing importance with the distance from 
the source of authority). And then you apply the principle of subsidiarity 
(respect the functionalities of the granular organization - the 
responsblity of its own governance). This way you can keep understanding 
complexity while not being embarassed by it. Life is not democratic but is 
often  coalescent - so is the human connexion, communication, relation 
system. You do not ask your telephone to be democratic, but to work.

In this global (Anglo/French meaning) vision, cybernetic keeps looking at 
independent organizations but from the whole environement (and not only 
from the substrats) in which they are embodied.

The center of the network is no more the root servers or HIP or IANA, etc. 
It is the users consensus/dissensus. Whatever DARPA, DHSARPA, ETSI, IETF, 
ITU, AFRAC (us), MINC, CHINA, JAPAN etc. may propose the real life user 
system adopts. 33 years to build a 700 millon internet system, a less than 
ten to build 1.3 billion mobiles network. And an absurd proposition to 
create a mobile TLD instead of working on a mobile scheme and to make 
tel://myname.org working. And the absurd idea to use our own private space 
TLD '.m").

I suppose that FLAPPS is a way to address that kind of need, from what I 
gather?

OK. This only introduces another type of "puts" (the "sideput" in addition 
in/outputs) in the cybernetics model [and AI) - which clarifies (Occam's 
Razor) a lot the inter relations, as being "intelligent" (as in "good 
intelligence") but also as in "Intelligence Service" and as in "Intelligent 
Ubiquity" (you really need to be intelligent to integrate all that :-). 
Actually you observe though the wording itself that it is back to the 
simplest common sense. But not only at human/machine logic but 
society/network noosphere (cf. Theilard de Chardin).

Back to the Internet entwork application : this means that you cannot 
consider IP alone. You need to consider it (and its development at at every 
level) together with what other communications technologies and needs may 
mean/bring, etc. This integration/simplification (again the Occam's Razor) 
cycle [we are cybernetics, what I name itero/deduction] will probably never 
end. In term of relations networking architecture, this leads to permit to 
determine very simply the cybernetic path from one person to another as not 
necessarily beingthe the straight line, but the less complex, the less 
dangerous, the most effective etc. line(s). This is true for bare humans, 
as well as with net/computer assisted humans.

The work that WSIS asked to UN to carry before Tunis, is just for them to 
understand that, and tell how to implement it, in the four governances 
poles (technical, political, economical and societal).

The change for us all, after the WSIS resolutions, is that the buyer (the 
world usership) has started publishing its RFP (resolutions). The process 
is very common : the first set of documents uses the model and the wording 
of the current supply. Then it progressively switches to the wording of the 
possible supply, then to the wording of the credible demands and ends in 
challenging everyone for innvation and helping new demands. I suppose 
"Tunnet" (WSIS 2005 in Tunis) will be different from Internet.

BTW, I happen to have signed year an NDA about a project based upon the ENS 
model. Its diagrams were therefore attached to the NDA (one single page) to 
explain the R&D environment. We were five to co-sign. Their reading and 
general understanding (enough for them to accept it as clear enough in a 
legally binding agreement) took them two minutes and no question.

IMHO, the points you make well in responding to Stephen, cannot be fully 
addressed if you do not consdier layer 8 (interapplication) and the user 
perspective (layers above). I do not say that my model is perfect (ity 
started from experience and the need to support innovations which among 
others included what became the web). I say that in not failing me for 18 
years, it shown me the need to have such a simple model in common to 
proceed further on.

>but the underlying philosophy behind it still remains the same.

So you confirm "something that resemble" (we agree). Please, let us not 
confuse IP and packet switch.

>>I propose IPv6.010 numbering scheme to be defined as a universal 
>>technology+routing+addresing+sub-adressing scheme. For that reason and to 
>>validate IPv6 as a multi-numbering-plan solution. If we do not start with 
>>2 plans, how will we be sure IPv6 protocol, softwares and equipement are 
>>multi-numbering-plan compliant?
>
>some of the people some of the time, you can always piss off all people 
>all of the time."
>
>Of course, multiple addressing schemes tend to beg the question of "Why 
>have two if one suffices?" (the usual necessary and sufficient argument, 
>Occam's Razor again) Which leads full circle back to identifiers vs. 
>locators. Wash. Rinse. Repeat.

No. IPv6 is multi adressing plans. By nature.
Either you say that IPv6 will never use IPv6.010 etc. plans or you respect 
the RFCs.
To use the RFC and to make sure they cannot be respected leads to more 
confusion.
All the more that the political/commercial interest is too visible.

Now, the Occam's Razor question is obvious : why to have the current IPv6 
plan when there are already other plans and need for other plans. Would it 
not be simpler to get one single unified numbering plan. What is the 
IPv6.010 we propose. Including Internet, TV, mobile, vehicles, radio 
frequencies, document sources, geographic locations, product tracing, etc.

>FLAPPS stemmed from the URL-based routing and forwarding work in web 
>caching I did a number of years ago with another advisor. It's 70,000 
>lines of code and will hopefully be more widely available after I 
>graduate. Yes, the code has been demonstrated to do what it claims, but 
>the glaring part missing is DHT emulation -- which I've tried to avoid, 
>but will have to do in order to satisfy recurring reviewer comments.

- DHT?
- question: what is a DNS based system not providing that FLAPPS provides ? 
(we work on a conceptual progressive (compatible) evolution of the DNS 
towards a generalized/global service) ?

(again "global", in an Anglo/French meaning, i.e. "all the parts of a 
whole"). Theerefore with a focus on the specific diversity of the parts 
[peer to peer], within the respect of their unique "tier and tier" system.

This permits you to understand what we could call a national firewall. I 
wll take the DHS analogy. Up to now, American culture people tended to 
protect their life and family on their doorstep. With their own gun. In a 
never attacked country it made sense not to overspend money and restrict 
rights. This kind of protection could be assimilated to the current 
firewalls. To protect oneselves agains penetrations.

9/11 shown the USA they could be attacked home. So you started developping 
a national fire wall system, named DHS. To protect your families, cities, 
etc. a step further. This is not Army, but this is no more private or 
community police. Most of the countries have that for a while. This 
firewalling is however not to be of the same nature (this would be a 
liberty killer : like fortifications, or as you say, a Ligne Maginot).

When you look at the threats on/from the network, you see they vary fwith 
your point of view. When you consider your machine :current firewalls are 
ok. When you consider applications Intelliwall papers explain well what you 
must consider (yet they do not fully put the emphasis about threats on 
distributed applications): this show there is a step above traffic 
filtering. Threats on groups of users (agora, VPN, Externets) are on their 
access gateways, directory structures, etc. These groups can be of 
different size (familly, corporations, universities, cities, regiions, 
nations, trades, etc.). The global threats are on the directory roots and 
on the local views of these roots (local names, anycasts): this is what we 
are at.

Now, wars always produced progress. While working on roots view security 
for surety reasons we obviously uncover new possibilities and possible 
innovations. This is also what interest us.
jfc

---

From: Scott Michel <[email-masked]>
Date: Mon, 22 Mar 2004 13:05:32 -0800

> tunnels don't seem a workable solution.

Tunnelling can exist at multiple layers. Overlays are just a different
version of tunnelling. Proxies can be viewed as a very limited form of
application tunnelling. Dealing with the complexity of different tunnelling
methods and requirements makes my handwave less tractable (which was
actually more to my point.)

> may be a good starting point to determine what, if any, additional

No argument there.

---

From: Scott Michel <[email-masked]>
Date: Mon, 22 Mar 2004 12:59:26 -0800

> electric and frame protection).

I'm not confusing layers at all. I'm looking at the system view as you
proposed and came to my particular conclusion. Even the certain national
entities and the control they attempt to assert still have to deal with
some of the fundamental "international" problems like address allocation,
TLD server location and replication, etc. That's why I characterized the
idea as the Internet version of the Maginot Line: It's intimidating, looks
good, but eventually gets overrun by progress and reality.

I would agree with you that cyberspace, for lack of any better term, is
an integral part of national infrastructure and needs protecting. I'm
less inclined to agree with anyone that wars take place in cyberspace,
as the concept of war goes in the taking of territory and national
assets (I'd really like to see a national entity "conquer" Google or
Amazon.com, for example.) Disruption is the most important element of
protecting the cyberspace national asset and preventing disruption 
is indeed a problem seeking a solution. But it seems as if the problem 
statement can be taken so far that it divorces itself from reality -- there
are a lot of physical systems that we tend to fall back on when cyberspace
fails. In other words, even if Amazon.com is disrupted and a portion of US
GDP goes out of commission, and given the network effects of disrupting
Amazon.com and the amplification of the network effects due to the speed
at which information can propagate ("good news travels fast, bad news
travels FTL"), it wouldn't crater the US or global economy. It would make
the punctuations in the equilibrium sharper (rift vs. crack) and the return
to a new equilibrium state longer as the system bridges or repairs the
rift. The difference today is the timeline: it's no longer millions of
years.

> different understandings (I would say before and after the e-networks). 
> The way Wienner, Ampere or Watts first thought of it. You would name it 
> today organization "governance" (from Plato's "kubernetes", the way/art of 

I'm not sure I grok this paragraph, although some references would be
useful.

> system. You do not ask your telephone to be democratic, but to work.

I understand the general idea here, but a few extra references would be
helpful to grok it (e.g., generalized cybernetics theory papers.)

> I suppose that FLAPPS is a way to address that kind of need, from what I 

Actually, I never had such grand visions for FLAPPS. It's just a way of
looking at P2P infrastructures and trying to reduce the amount of
redundant effort that goes into building them. I'm not sure that a
consequence of my work is a larger contribution to addressing
philosophical or epistemological questions, but I'd rather interested in
understanding the larger issues FLAPPS might address in that context.

> confuse IP and packet switch.

I was only considering IP-the-packet-protocol -- the rest of the
program-speak is dressing to market the idea. No reason to throw out
IP-the-packet-protocol when it just works. I agree with the larger problem
of additional layers, which additional layers and models actually work
based on research and overall consensus given the tractability of the
models and interaction between protocols at various layers is the question
DARPA is asking.  "Replacing IP-the-interacting-protocols (with what?)" is
a non-question because it implies that IP-the-interacting-protocols is
inherently defective -- with which I don't agree at all.

> >but will have to do in order to satisfy recurring reviewer comments.

Distributed Hash Tables, of which there are many (Chord, CAN, Pastry, 
Plaxton-based systems, etc).

> - question: what is a DNS based system not providing that FLAPPS provides 
> ? (we work on a conceptual progressive (compatible) evolution of the DNS 

DNS resolves/provides a mapping of X to Y (name to IP address, name to
CNAME to IP address, etc.) FLAPPS isn't a resolver service but a P2P
(or tier-to-tier) routing and forwarding infrastructure. FLAPPS uses
composable names as routing identifiers, inasmuch as the URLs and URNs
can be decomposed and used as routing identifiers between cache groups.
Add some flexibility to the routing protocol so that the updates can
carry additional data, and new message forwarding behaviors are the
result (besides the usual shortest distance forwarding behavior.)

Even if I were to propose that FLAPPS were more than an application-level
routing and forwarding infrastructure, I  would have to answer the question
of where the inter-application layer is placed. Clearly (or maybe not so
clearly) FLAPPS provides an inter-application function, but does that layer
live at the same level as FLAPPS does or above?

> liberty killer : like fortifications, or as you say, a Ligne Maginot).

9/11 showed very plainly that assymetric warfare works and protecting
against assymetric warfare requires a lot more dilligence on a larger
number of fronts than previously imagined or considered. The more complex
the network and its interconnections, the harder it is to control or
monitor (take the US borders or ports as two good examples.) But that's
merely stating the patently obvious.

> ok. When you consider applications Intelliwall papers explain well what 
> you must consider (yet they do not fully put the emphasis about threats on 

The more the system is controlled, the sharper the punctuations in the
equilibrium become. By breaking the system into smaller compartments,
the easier it becomes to take out the compartments no matter how well
designed the compartment's protection. But that's not all: compartmentalizing
is a constraint relationship; there are so many more of them that must
be disrupted to have an effect. The ideal would be to figure out how to
remediate the damage as it is perpetrated, i.e. self-healing systems.
In a lot of respects, IP-the-interacting-protocols is a self-healing system.

> innovations. This is also what interest us.

No argument there -- after all the Von Neumann architecture was a direct
result of H-bomb research.

-scooter