Re: Edits to Teredo Security concerns

[Jim Hoagland <jim_hoagland@symantec.com>]

On 7/6/07 12:13 AM, "Rémi Denis-Courmont" <rdenis@simphalempin.com> wrote:

> And if that is not satisfactory, then it's all about "You cannot rely on
> 
> stateful firewalling to block tunnels", and it's not a Teredo protocol
> 
> issue.

I think perhaps I should say what the goal is with inspection:  to be able
to apply the same content inspection as is done for native IPv4 or IPv6 to
Teredo.  This content inspection could be done in a firewall, IDS, router,
etc.  Content in this case meaning the layer 3+ part of the communication
(as opposed to tunnel overhead).

This inspection requires the ability to find the content.  That is
straightforward for native IPv4 or IPv6, but is expensive to do for Teredo
tunneled content.

-- Jim