Subject: [mobile-ip] A Race condition which may cause denial of service if network con dition persist

From: "Ahmad Muhanna" <[email-masked]>
Date: Fri, 9 Aug 2002 10:41:12 -0500

Hello Charlie,

This is a race condition where the FA and the MN does everything according
to the standard 
BUT still this scenario may cause a denial of service for many Mobile Nodes
when the network 
"probably" is handling a heavy traffic or more explicitly when it takes
about a second 
for the FA to receive the RRP from the HA for any DYNAMIC BASIC/Reverse
Tunnel Mobile IP call.

Background:
According to the standard (RFC3220) Mobile Node can not send RRQ messages
with less than one second interval.
In other words, Mobile Node must wait at least one second before retrying to
register with the same FA.
Now as we know that Air time (Wireless) is the most precious thing for
carriers, Carriers MAY very well configure 
their Mobile Nodes with a retry timer of "1 second".

Details:

MN					PDSN
HA
------					-----------
-----

<<<<<=======  Agent Adv. FAC=C1  ==== (1)

(2)===== RRQ 	============>>>>>>>>>
		Home Address  = 0.0.0.0
		ID		= ID1
		FAC		= C1
					       (3)===== RRQ
============>>>>>>>
							Home Address  =
0.0.0.0
							ID		=
ID1
							FAC		= C1

					        <<<<<<===== RRP
==========  (4)
							Home Address  =
a.b.c.d.
							ID		=
ID1
							FAC		= C1

   <<<<<<===== RRP 	===============(5.1)	{Mobile Node is REGISTERED
with Home Address = a.b.c.d.}
		Home Address  = a.b.c.d.
		ID		= ID1
		FAC		= C2

(5.2)===== RRQ Retransmission ====>>>>>    		{Since Mobile Node
is Registered C1 is Used Challenge}
		Home Address  = 0.0.0.0
		ID (timestamp)	= ID2
		FAC		= C1

** Mobile Node ignores the RRP(5.1) since it already sent a retransmission
RRQ with ID2.

   <<<<<<== RRP (code=106 Stale Challenge) ==(6)
		Home Address  = a.b.c.d.
		ID		= ID2
		FAC		= C3

(7)===== Agent Solicitation Msg ====>>>>>    

<<<<<=======  Agent Adv. FAC=C4  ==== (8)

(9)===== RRQ 	============>>>>>>>>>		{C4 is not USED BUT Mobile
Node is Registered with Home Address = a.b.c.d. NOT 0.0.0.0}
		Home Address  = 0.0.0.0
		ID		= ID3
		FAC		= C4

 <<<= RRP(code=99 Home Address missing)==(10)
		Home Address  = a.b.c.d.
		ID		= ID3
		FAC		= C5

This scenario continues and eventually MN takes down the call after
exhausting all retries.
There is a big possibility, if the network condition persists, MN will not
get service.

Although this is a race condition but it is very possible and may cause a
denial of service to
some Mobile Nodes for some time.

Charlie,
Your comments is greatly appreciated.

Regards;
Ahmad Muhanna