Subject: RE: [tcpm] ICMP and TCP

From: "Bora Akyol" <[email-masked]>
Date: Fri, 19 May 2006 11:05:16 -0700

After reading the tcp/icmp draft, this is what I am suggesting.
 
The logic for what constitutes a hard error vs what constitutes a soft
error is getting convoluted. 
 
Error X is hard when TCP is in Y state, but not Z state, and it is
ignore
when TCP is in Q state but not when in X state. Otherwise, it is a soft
error.
 
Yep, as a software engineer, I believe anything can be made to work
given enough time
and devtest, but at what cost.

What if we unplugged TCP from ICMP altogether. What exactly do we lose?

1) Path MTU, this is an IP layer functionality. TCP is just a bystander.

2) Port unreachable, host unreachable etc type messages. This can be
fixed within TCP itself 
by reclaiming resources are generalizing some of the optimizations
presented in draft-eddy-syn-flood.

3) Source quench. Yawn, who cares ;-)

So what else do we lose if we lose ICMP altogether?

Sorry, not trying to be controversial here, just trying to take a
different approach.

Thanks

Bora

________________________________

	From: Templin, Fred L [mailto:[email-masked]] 
	Sent: Friday, May 19, 2006 10:54 AM
	To: Bora Akyol; [email-masked]
	Subject: RE: [tcpm] ICMP and TCP

	Bora - are you suggesting that TCP should ignore all ICMPs? I
	think I can understand the motivation, but some might object.
	 
	Fred
	[email-masked]

________________________________

	From: Bora Akyol [mailto:[email-masked]] 
	Sent: Friday, May 19, 2006 10:49 AM
	To: [email-masked]
	Subject: [tcpm] ICMP and TCP

	Should we stop beating around the bush and cut the cord between
these two altogether? Even
	PMTU discovery is really an L3 function.
	 
	What the icmp/tcp draft proposes turns all hard errors to soft
anyway, why not just cut the cord and
	let TCP react to only the other peer TCP.
	 
	Bora

_______________________________________________
tcpm mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tcpm

---

From: "Templin, Fred L" <[email-masked]>
Date: Fri, 19 May 2006 11:30:50 -0700

Bora,

> 1) Path MTU, this is an IP layer functionality. TCP is just a
bystander.

How can you expect the IP layer to implement robust Path
MTU when ICMP "packet too big" messages may be forgeries
or missing altogether? See:

http://www.ietf.org/html.charters/pmtud-charter.html

Fred

---

From: Fernando Gont <[email-masked]>
Date: Sat, 20 May 2006 02:05:37 -0300

>error is getting convoluted.

Please read the David D. Clark's paper on fault isolation and 
recovery (referenced in my "TCP's reaction to soft errors" draft), 
and/or see my presentations (ICMP attacks and TCP soft errors) at IETF 64.

>1) Path MTU, this is an IP layer functionality. TCP is just a bystander.

?

>presented in draft-eddy-syn-flood.

ICMP provides more specific information about what is really going on.

The point is not to remove ICMP, or to blindly trust it.

The point is to use it while it's useful, in the right way, till the 
point it begins to affect the security of the protocols that depend on it.

Kindest regards,

--
Fernando Gont
e-mail: [email-masked] || [email-masked]
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1

---

From: Fernando Gont <[email-masked]>
Date: Sat, 20 May 2006 02:05:37 -0300

?

Kindest regards,