Subject: RE: ttl = 255 and scope limited to lan ..why?

From: Vikram <[email-masked]>
Date: Fri, 20 Jul 2001 11:56:14 -0700 (PDT)

There are two things here:
First is you must send out a packet with TTL 1 only.if you are doing it
on purpose (and if receiver is concerned abt security) u will be having
the  authentication fields to be taken care of.
Second is a rather interesting point which I am not sure of:

Suppose you have the following config:
	
-------
| A    |
--------
  1|
----------LAN1
   |2
-------
|  B   |
--------
   3|
---------------LAN2
    |4
   --------
   | C     |
   ---------

A,B,C are all routers on which '3'is backing up '4' and 
'2' is backing up '1'(just presume B has all the prereq to backup both
A,C not necessarily shown in fig) Thus both 2,and 3 will join the vrrp
grp(112)
Thus if you(B) get a vrrp pkt from LAN2 u check to see if u r
subscribed
for this group on 3 {<3,112> tuple} and if yes you process it.Your
incoming interface table will have <3,112> entry and so you will
process this pkt (ie send it to intended application(vrrp) in ur box)

Now an application(vrrp) on the box B has subscribed to receive pkts
which come in from 2(ingress side) also. Thus if you forward the packet
internally from 3 to 2 (ie to egress side of 2) that is either
1. wrong implementation of mcast functionality. or
2.will never happen coz the outgoing interface table will not have the
<2,112> entry.

thus while our incoming interface tables will contain two entries
<2,112>,<3,112> our outgoing interface tables shouldnt contain anything
so question of forwarding doesnt arise. 

I am not fully sure if my hypothesis for case 2 is right. Please do let
me know.

Thanks 

Vikram

--- "A. K. Srikanth" <[email-masked]> wrote:
> Well the point is that if I sent a packet with TTL 3 from 2 hops away
> it
> will be 1 by the time it reaches the router in question..The
> bottomline
> being it is not possible to tell how many hops a packet has been
> through
> when it reaches you with a TTL of 1 whereas you can always tell that
> it has
> not gone through a router if the packet has a TTL of 255 when it
> reaches
> you.
> 
> 
> 
> Thanks,
> Srikanth
> 
> 
> 
> > -----Original Message-----
> > From: Vikram [mailto:[email-masked]]
> > Sent: Friday, July 20, 2001 1:26 PM
> > To: Peter Hunt
> > Cc: [email-masked]
> > Subject: Re: ttl = 255 and scope limited to lan ..why? 
> > 
> > 
> > well if you send out pkts with ttl=1 in first place, it will 
> > not travel
> > more than one hop anyways. 
> > 
> > Also if you are a multicast router then you shhould never forward a
> > datagram with addresses of 244.0.0.x as 
> > destination,regardless of ttl. 
> > 
> > So the possibility of originating from more than one hop away
> doesnt
> > exist ie receving a misconfigured packet.
> > 
> > And besides,the vrrp pkt shld also clear numerous other checks to
> be
> > accepted as a valid vrrp pkt- ie Authenication issues.
> > 
> > Vikram
> > 
> > --- Peter Hunt <[email-masked]> wrote:
> > > > RFC says that ttl shld always be set to 255 in vrrp pkt. and
> also
> > > that
> > > > the scope of each VR is restricted to a single lan. If that is
> the
> > > case
> > > > wouldnt it better if the ttl was set to 1 instead?
> > > 
> > > It's possible that a packet with ttl of 1 originated from 
> > more than 1
> > > hop away. So it would be possible to inject protocol packets from
> > > another
> > > network.
> > > 
> > > By requiring a ttl of 255, you can ensure that protocol packets
> > > weren't
> > > forwarded from another network.
> > > 
> > > 	Peter.
> > > 
> > 
> > 
> > =====
> > ----
> > NO sense being pessimistic. It wouldnt work anyway
> > 
> > __________________________________________________
> > Do You Yahoo!?
> > Get personalized email addresses from Yahoo! Mail
> > http://personal.mail.yahoo.com/
> > 
> 

=====
----
NO sense being pessimistic. It wouldnt work anyway

__________________________________________________
Do You Yahoo!?
Get personalized email addresses from Yahoo! Mail
http://personal.mail.yahoo.com/

---

From: Ben Black <[email-masked]>
Date: Fri, 20 Jul 2001 19:35:10 -0700

You are completely ignoring malicious applications.  While it is very
unlikely that someone would misconfigure their devices in such a way
that VRRP link local multicasts are forwarded, the cost of using a TTL
of 255 to guarantee that a packet was not forwarded is essentially nil.

What is the benefit of using a TTL of 1?

Ben