Subject: RE: How to move forward in the HAO & ingress filter discussion

From: "Hesham Soliman (ERA)" <[email-masked]>
Date: Tue, 15 Jan 2002 13:49:00 +0100

Francis

  >    I have a proposal. But first, let me make some observations:
  >    
  >    - Most people do seem to agree that HAO reflection is an
  >       issue that needs to be dealt with somehow.
  >    
  > => we have to deal with it but we don't need a stronger solution
  > than today ingress filtering which is a BCP, i.e. something like
  > a SHOULD.

=> But how can that be true ?? Today's ingress filtering 
is clearly insufficient for HAO issues. Or perhaps you
mean we need a solution that doesn't have to be mandated
(SHOULD instead of MUST) ? If so, this is too early to discuss, 
we don't have an agreement on a solution yet. 

I haven't heard anyone answering my question as to why
reverse tunnelling by the MN thru the HA is so much 
worse than triangular routing, that we need to develop 
something new to fix the HAO problem 'only sometimes'.

Hesham

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Francis Dupont <[email-masked]>
Date: Tue, 15 Jan 2002 14:25:27 +0100

> than today ingress filtering which is a BCP, i.e. something like
   
   => But how can that be true ??

=> the answer is both bad and good news: ingress filtering is effective
against random source address snooping, but not against DDoS itself
or source address snooping using a small variation on the last bits
(i.e. staying in the same prefix). Of course the last point is very
worrying for IPv6 (maximal prefix length is 64 bits, i.e. 64 bits at
least are free for this kind of attacks). But this is more a threat
against RFC 3041 than HAO...

   Today's ingress filtering is clearly insufficient for HAO issues.

=> do you mean we have to do more about HAO than about standard
source address snooping?

   Or perhaps you mean we need a solution that doesn't have to be mandated
   (SHOULD instead of MUST) ?

=> exactly, we don't need something stronger than a BCP (a loose SHOULD).

   If so, this is too early to discuss, 
   we don't have an agreement on a solution yet. 
   
=> my concern is we have no agreement on the problem too.
(I don't put a smile because this is no more funny)

   I haven't heard anyone answering my question as to why
   reverse tunnelling by the MN thru the HA is so much 
   worse than triangular routing,

=> d(bidir tunnel) = 2 * d(MN,HA) + 2 * d(HA,CN)
   d(triangular) = d(MN,HA) + d(HA,CN) + d(MN,CN)
   d(optimization) = 2 * d(MN,CN)
and we always have d(MN,CN) <= d(MN,HA) + d(HA,CN)
so d(optimization) <= d(triangular) <= d(bidir tunnel)
and even stronger 2 * d(triangular) = d(optimization) + d(bidir tunnel)
i.e. in my poor English the cost/performance of triangular routing
is at the middle of bidirectional tunneling and routing optimization.

   that we need to develop 
   
=> my argument is that ingress filtering is an 'only sometimes' reply
to the (random) source address spoofing problem.
If your question is "why not drop the draft 15 and restart from the
beginning with a bidirectional tunneling (only in the first phase) solution",
this is another (interesting) question (I suggest to restrict it to the
mobile IP WG list).

Regards

[email-masked]

---

From: Pekka Savola <[email-masked]>
Date: Tue, 15 Jan 2002 16:24:03 +0200 (EET)

> is at the middle of bidirectional tunneling and routing optimization.

In theory, yes.  But the question is, does it really make that much of a 
difference as long as at least one way is "unoptimized"?

Practise?  I don't think there's much difference in bidir
tunnel/triangular routing; I doubt e.g. TCP would be able to get much
better performance from triangular than from bi-dir (and there are goals
like hiding your origins that triangular cannot solve).

-- 
Pekka Savola                 "Tell me of difficulties surmounted,
Netcore Oy                   not those you stumble over and fall"
Systems. Networks. Security.  -- Robert Jordan: A Crown of Swords

---

From: Francis Dupont <[email-masked]>
Date: Tue, 15 Jan 2002 16:04:22 +0100

=> the same difference than when both ways are unoptimized or optimized.
Difference in distance is the same, difference in byte overhead too.
This is true for all points with one exception: protocol complexity
because triangular routing has roughly the same complexity than
bidirectional tunneling.

   Practice?  I don't think there's much difference in bidir
   tunnel/triangular routing; I doubt e.g. TCP would be able to get much
   better performance from triangular than from bi-dir (and there are goals
   like hiding your origins that triangular cannot solve).
   
=> I can't see how TCP is involved. I believe your argument is different:
if the traffic is very asymmetrical (more on one way than on the other),
you prefer to have it on the optimized way...
I am afraid the real argument against the triangular routing is this
discussion itself because the main triangular routing advantage comes
from the (future) fact that HAO is supported by every IPv6 nodes.
With enough FUD this shall never become true and the advantage shall vanish...
I'd like to get the opinion of IPv6 implementors (if they don't filter out
this boring discussion) about HAO (for it, against it, will/won't implement
it, will/won't enable it by default, etc).

Regards

---

From: Pekka Savola <[email-masked]>
Date: Tue, 15 Jan 2002 17:22:46 +0200 (EET)

> because triangular routing has roughly the same complexity than

What about latency (e.g. interactive session) detected by the user? (might 
be the worst of the two)

Reliability is one argument too.

> you prefer to have it on the optimized way...

I think I'd prefer to have it either _completely optimized_ or _completely
unoptimized_, not optimized to one direction and unoptimized to the other.

> With enough FUD this shall never become true and the advantage shall vanish...

Yes.  But in all reality, a user who requires mobility (e.g. moving fast) 
would be a fool to rely that all CN's would implement this (or else the 
connection breaks) during the next 3 years or so..

Triangular routing relies on the existance of this feature everywhere.

Bidirectional tunneling always works, and in practise *may* (I don't know) 
be roughly equal in user-detected latency, TCP thoughput, etc.  Does it 
not seem Bidir is far superior to triangular routing?  (As a matter of 
fact, bidir does not really even require MIPv6 -- I don't think there's 
any feature missing in current specifications that would be required :-).

---

From: Erik Nordmark <[email-masked]>
Date: Thu, 17 Jan 2002 11:40:53 +0100 (CET)

>Hesham wrote:
> Francis wrote in response:

Yes, but does that make any significant difference for real traffic and 
applications given than the traffic from CN to MN goes through the HA 
in the triangular case?

For instance assume that the CN and MN are next to each other (delay 1 ms) 
and the HA is 100 ms away from them (one way delay).
If you route optimize TCP will see a RTT of 2 ms.
If you do triangular the rtt will be 201 ms.
If you do bidirectional tunneling the rtt will be 400 ms.
You can look at these numbers differently depending what you want to
prove. "400/201 = 2" would make your argument.
But my argument is that "201/2 = 100".
Thus if you care about rtt when the CN/MN are close compared to the MN/HA
delay you should route optimize.

The only case I can think of where tringular makes a significant performance 
difference is for unidirectional and latency sensitive traffic from MN to CN.
I have yet to see an application which such concerns - if latency is
an issue it is because you'd like the higher level entities (transport
protocols or humans e.g. on a voice/video conversation) to observe 
short roundtrip latency.

   Erik