Re: Firewall "uniformity" issue

[Iljitsch van Beijnum <iljitsch@muada.com>]

On 28-apr-2005, at 20:33, Erik Nordmark wrote:

> If we assume we always have deferred shim context establishment,  
> then the timeliness of the shim setup isn't critical, hence it  
> makes sense to avoid penalizing the data traffic (with firewall- 
> related loss, or differently protected by a SG). With this  
> assumption I think it makes sense to not try to put the two in the  
> same packet.

I agree that in most cases we wouldn't want to do this, but I also  
think being able to have the shim setup in transport/data carying  
packets will come in handy in the future. One very important aspect  
of having the shim setup in the initial packet is that the initial  
packet is the only one an attacker with sniffing capability can't  
guess about.