Subject: RE: [tcpm] Some feedback on draft-ietf-tcpm-tcp-antispoof-04.txt

From: "Caitlin Bestler" <[email-masked]>
Date: Thu, 18 May 2006 09:27:16 -0700

Fernando Gont wrote:

> 
> As for the filtering of ICMP messages, it is interesting to
> note that while ICMP messages can be inserted anywhere in the
> network (without even needing to spoof the source IP
> address), address spoofing *is* needed in the ICMP payload,
> and thus ingress/egress filtering can be performed based on the ICMP
> payload. 
> 

I thought we were trying to encourage deployment of ingress/egress
filtering, not make it more difficult and provide more excuses 
not to do it.

_______________________________________________
tcpm mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tcpm

---

From: Joe Touch <[email-masked]>
Date: Thu, 18 May 2006 22:08:31 -0700

Caitlin Bestler wrote:
> filtering,

I can't say we are. While it may be useful in some circumstances, it's a 
hefty local penalty to pay for a global benefit that's largely defeated 
when any leaf fails to participate; that's not the kind of system that 
encourages early adoption.

Joe

---

From: Fernando Gont <[email-masked]>
Date: Fri, 19 May 2006 01:41:28 -0300

>filtering, not make it more difficult and provide more excuses

This is by no means providing more excuses.

It is simply stating that it can be done, in addition to that 
performed on the source/destination IP addresses of the IP packet.

For instance, many firewalls already implement this type of filtering.

Kidnest regards,

--
Fernando Gont
e-mail: [email-masked] || [email-masked]
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1

[email-masked]
	d.broadcom.com>
Cc: Joe Touch <[email-masked]>

>filtering, not make it more difficult and provide more excuses

This is by no means providing more excuses.

It is simply stating that it can be done, in addition to that 
performed on the source/destination IP addresses of the IP packet.

For instance, many firewalls already implement this type of filtering.

Kidnest regards,

--
Fernando Gont
e-mail: [email-masked] || [email-masked]
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1