Re: threats ID

[Brian E Carpenter <brc@zurich.ibm.com>]

Masataka, you conclude by saying

> However, TCP is not IP, which is the point of my presentation
> at Vienna.

We can hardly disagree. But TCP is not SCTP, UDP, DCCP or ICMP either.
The systems level argument for a layer 3.5 solution is that it can cover
all cases, including ones we have not invented yet.

You are correct that a layer 3.5 solution requires cached state, probably
with timeouts due to the lack of disconnect signalling. There is a classical
solution to that, which is for the ULP to send a keepalive signal to prevent
the cache from timing out. That would indeed be a ULP enhancement, but a very
minor one and not essential.

   Brian

Masataka Ohta wrote:
> 
> Kurt;
> 
> >>>I believe NOID and certainly ODT allow layer 4 to work without
> >>>changes,
> >>
> >>You can believe so, just as you can believe NAT allow layer 4 to work
> >>without changes.
> >
> >
> > I think there is a notable difference. In my reading you are using NAT
> > very loose for all forms of address rewrite. NAT to me does static
> > rewrites, with no form of signaling.
> 
> Wrong. Rewriting is not the essential problem.
> 
> Right. The problem is lack of signaling OF *CONNECTIONS*.
> 
> As you might know, there is no connections and signaling at
> the IP layer.
> 
> Thus, the only thing NAT and other layer 3 things can do is
> guessing the connection state by a lack of communication
> for certain period of time, though, sometimes, you can detect
> TCP SYN and FIN.
> 
> However, that you observe no traffic over a connection does
> not necessarily mean that the connection is broken.
> 
> That there is no response for a UDP packet may mean that an
> reply ack is lost, that no reply is required by the protocol
> above UDP or that the packet is an ack.
> 
> There is no signaling unless layer 4 and above are involved,
> though guessing may work for TCP.
> 
> > Especially breaking referrals by
> > hiding the "true" address to the outside world. Most (if not all)
> > id/loc proposals here (claims) that referrals do work. There is a hugh
> > difference, referrals is a crucial component of any multi6 solution.
> > This was also pointed out in the comments by Patrick.
> 
> NAT rewriting is transparent to applicaitons, if the applications
> relies on TCP and DNS and DNS is modified to reflect the rewriting.
> 
> So are other proposals, including mine, as is explained in
> my proposal.
> 
> However, TCP is not IP, which is the point of my presentation
> at Vienna.
> 
>                                                 Masataka Ohta